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In  a  people  ready  business,  ROI  stands  for 


Are  your  people  ready? 


Where  do  new  products  come  from?  How  about  new  services?  Or  new  and  better  ways 
of  working?  A  people-ready  business  has  the  answer:  It's  people,  empowered  by  the  right 


software.  Software  that  streamlines  the  creative  process,  organizes  the  production  process, 
and  connects  people  who  have  ideas  with  people  who  can  manufacture,  distribute, 
and  sell  them.  That's  the  foundation  of  a  successful  business.  A  people-ready  business. 
Microsoft®  Software  for  the  people-ready  business!"  microsoft.com/peopleready 


Your  potential.  Our  passion. 

Microsoft 
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NEW  DELL™  POWEREDGE™ 
SERVERS  FEATURE  THE 
RELIABILITY  OF  DUAL-CORE 
INTEL®  XEON®  PROCESSORS. 


PURE  INSIGHT  TO  SYSTEM  STATUS 

NEW  DELL  POWEREDGE  SERVERS  WITH  BUILT-IN  LCD  DISPLAYS. 


Introducing  the  new  PowerEdge  family.  It  was  born  to  reduce  complexity.  System 
status  is  available  at  a  glance,  allowing  you  to  diagnose,  maintain  and  conquer 
datacenter  chaos  like  never  before.  For  a  360°  online  view  of  this  pure  leap 
forward,  visitwww.dell.com/poweredge.  Streamline  without  sacrifice.  That's  the 
direct  path  to  success.  That's  pure  Dell. 


PURE 


www.dell.com/poweredge 


1.866.218.7713 


Del!  cannot  be  responsible  for  errors  in  typography  or  photography  Dell,  the  Dell  logo  and  PowerEdge  are  trademarks  of  Dell  Inc.  Intel,  Intel  logo,  Intel  Inside,  Intel  Inside  logo,  Xeon  and  Xeon  Inside  are  trademarks  or 
registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the  United  States  and  other  countries.  ©  2006  Dell  Inc.  All  rights  reserved. 


Bonhams  IT  Directc  Roland  Whitehead 
credits  a  Linux-based  auction  management 
system  for  the  mid-market  company’s  growth. 


42  China  Builds  a  Better  Internet 

cover  story  |  internet  strategy  Americans  have  been  hogging 
Internet  addresses  for  decades,  leaving  late-eomers  like  China  to  divvy  up 
the  few  remaining  slivers.  But  China  is  fighting  back  by  vaulting  to  an 
addressing  standard  that  could  rewrite  the  rules  of  the  Internet— and 
business  innovation— for  decades  to  come.  By  Ben  Worthen 

so  Sold!  On  Open  Source 

open  source  Building  their  own  infrastructure  has  helped  mid-market 
Bonhams  compete  with  the  auction  industry  superpowers. 

By  Meridith  Levinson 

57  Plan  Globally,  Deploy  Locally 

view  from  the  top  The  CEO  of  Manpower  explains  why  a  worldwide 
IT  organization  has  to  balance  global  efficiency  with  local  needs. 

By  Christopher  Koch 
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offshore  outsourcing  Risks,  rewards,  challenges  and  opportunities, 
country  by  country.  By  Stephanie  Overby 
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30  Steps  to  Prioritization 
project  strategy  Too  many  IT  projects 
are  based  on  bogus  cost  savings  projections 
rather  than  business  strategy.  Here’s  how  to 
link  project  prioritization  directly  to  value. 

By  Sai  Machavarapu 

34  Visibility  for  the  Board 
communications  With  boards  of  directors 
under  increased  scrutiny  by  regulators  and 
other  entities,  CIOs  should  consider  creating  a 
digital  dashboard  that  gives  them  a  view  into 
the  key  performance  indicators  of  the  business. 
By  Michael  Schrage 
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security  When  it  comes  to  collecting 
customer  data,  less  is  usually  more. 

By  Larry  Ponemon  more  .. 
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By  Michael  Friedenberg 

15  Trendlines 


Most  CIOs  know  that  educating  the  business  about 
IT  is  a  key  part  of  their  job,  but  many  struggle  to  find 
the  right  tools  and  tactics  for  a  given  situation.  CIO 
Executive  Council  members  share  tips  to  maximize 
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A  discussion  between  Verizon  CIO  Shaygan 
Kheradpirand  CIO  Executive  Editor  Christopher 

Koch.  ))  www.cio.com/podcasts/authors.html 


25  Essential  Technology 

Microsoft’s  next  big  operating  system 
upgrade  has  a  wealth  of  new  business 
features— but  how  badly  do  you  really 
need  them?  By  Dylan  Tweney 
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Deconstructing  a  Mega-Merger 

By  Scott  Kirsner 
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EMPLOYEE  PRODUCTIVITY 
ANDTHEWEB 

Should  companies  block  websites  to  prevent 
employees  from  wasting  time  on  the  job? 

CIO  Senior  Writer  Ben  Worthen  doesn’t  think 
so,  but  plenty  of  his  readers  disagree  with 
him.  Join  the  conversation. 
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A  LABOR 
SHORTAGE? 


blogs.cio.com/neteffect 


SUCCESSION  PLANNING 

You ’re  not  really  going  to  do  that  job  forever 
are  you?  Probably  not.  And  making  sure 
someone  is  ready  to  takeoverthe  reinscan 
sol  idify  your  reputation  with  everyone  you 
leave  behind. 


A  report  from  employ¬ 
ment  services  company 
Manpower  examines 
the  IT  labor  shortage 
paradox.  Plus,  a  podcast 
with  Manpower  CEO 
Jeff  Joerres. 
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Gigabit  to  the  edge 


.  LOL-L-L  LCAL/-L\w  Source 

of  power  and  performance 


It 


Switch  420M-48G 


The  incredible  speed  of  Gigabit  is  now  available  at  an  affordable  price. 
What’s  more,  this  comes  from  a  trusted  company  whose  dedication  to 
quality  and  reliability  allows  us  to  offer  the  industry’s  leading  lifetime 
warranty.  With  ProCurve’s  comprehensive  series  of  Gigabit  switches, 
businesses  can  now  confidently  and  cost-effectively  adopt  Gigabit 
right  across  the  network, 


View  the  HP  ProCurve  Gigabit  to  the  Edge  white  paper  at 
www.hp.com/go/procurvegig3  or  call  (800)  975-7684  Ref.  Code  gig3 


ProCurve  Networking 

HP  Innovation 


©  2006  Hewlett  Packard  Development  Company.  L.P 


Are  You  a 
Dinosaur? 


Enterprise  innovation  increas¬ 
ingly  is  being  driven  by  online 
consumer  technology.  CIOs 
who  don’t  pay  attention  to 
what’s  going  on  out  there 
could  be  facing  their  own 
extinction. 


A  few  issues  ago,  I  wrote  a  column  titled  “The  Next  Wave  Is  Here”  ( www.cio . 
com/031506)  about  the  profound  changes  taking  place  at  the  heart  of  enterprise  IT. 
Well,  if  those  internal  changes  are  profound,  the  ones  taking  place  at  the  edge  are  revo¬ 
lutionary.  And  they’re  also  what’s  driving  the  need  for  internal  IT  transformation. 

If  you’ve  been  reading  my  column  for  any  period  of  time,  you  know  I’m  not  prone  to 
hyperbole.  All  through  the  (first)  dotcom  era,  CIO’s  take  on  newly  emerging  Web  busi¬ 
nesses  was  pretty  conservative.  One  piece  we  wrote,  about  whether  CIOs  should  ditch 
their  jobs  with  traditional  companies  to  run 
IT  at  a  dotcom,  was  headlined  “Look  Before 
You  Leap”  {www.cio. com/110101)  and  pro¬ 
vided  a  rational  framework  for  making  that 
decision  amid  all  the  irrational  turn-of-the- 
century  exuberance.  (As  it  turned  out,  we 
were  probably  too  conservative  on  that  one. 

While  few  of  those  jobs  had  good  long-term  prospects,  it’s  hard  to  argue  now  with  the 
value  they  provided,  experiencewise,  as  a  tour  of  duty.) 

But  as  rational  as  we  are  at  CIO  ,  we’re  getting  pretty  exuberant  about  what’s  going 
on  today.  And  given  the  velocity  at  which  it’s  all  happening  and  the  extremely  con¬ 
servative  climate  we’re  coming  out  of,  some  good  old-fashioned  hype  just  might  be 
in  order. 

Innovation  today  centers  on  the  digital  consumer  and  is  spilling  over  into  business, 
said  Verizon  CIO  Shaygan  Kheradpir  at  last  month’s  IDC  IT  Forum.  There’s  a  flood  of 
cool,  simple,  creative  new  stuff  emerging  online  ever  y  day.  With  the  Internet  as  a  plat¬ 
form  for  testing  out  ideas,  the  cycle  time  to  determine  market  acceptance  is  insanely 
short.  (And,  by  the  way,  your  new  competitors  know  that,  even  if  you  don’t.) 

So  why  is  this  a  problem  for  CIOs?  For  one  thing,  too  many  of  you  don’t  spend  any 
appreciable  time  online.  You  don’t  know  what  a  vlog  is,  or  a  machinima  (I  didn’t  either 
before  this  week),  and  you’ve  probably  never  spent  time  in  MySpace  and  rarely  com¬ 
municate  by  IM.  You’re  dinosaurs.  I  am  too. 

Unlike  real  dinosaurs,  however,  we  have  an  opportunity  to  adapt.  But  we’ve  got  to 
get  out  there.  Carve  out  a  half  hour  a  day,  if  possible,  to  visit  some  of  the  Web’s  more 
unusual  neighborhoods.  Spend  some  time  in  the  virtual  world.  Find  a  vlog  (a  video 
blog)  about  something  that  interests  you.  Edit  your  home  videos  through  an  online 
service.  IM  not  just  with  your  kids,  but  with  other  interesting,  creative  people.  Hire 
young  people  and  encourage  them  to  tell  you  about  some  of  the  cooler  things  that  are 
happening,  because  you’ll  never  keep  up  on  your  own. 

After  about  a  month  of  this,  carve  out  some  time  with  your  colleagues  to  think 
about  the  360-degree  implications  of  these  things  for  your  business. 

The  biggest  risk  right  now  is  not  irrational  exuberance  but  rational  conservatism. 
And  as  we  all  know,  that’s  something  that  comes  naturally  to  CIOs. 


Given  the  extremely 
conservative  climate  we're 
coming  out  of,  some  good 
old-fashioned  hype  just 
might  be  in  order. 


Abbie  Lundberg,  Editor  in  Chief 

lundberg@cio.com 
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(IF  THE  NEW  DUAL-CORE  INTEL®  XEON®  PROCESSOR  WERE  AN  ATHLETE, 


WE'D  BE  LOOKING  AT  SOME  SERIOUS  ENDORSEMENT  DEALS.) 

INTRODUCING  THE  DUAL-CORE  INTEL8  XEON8  PROCESSOR  FOR  SERVERS. 

Up  to  80%  more  performance  per  watt  than  the  competition*  20  leading  performance  benchmarks. 

Up  to  60%  faster  with  significantly  lower  energy  consumption  than  the  competition.  All  that  and 
the  best  two-way  platform  for  virtualization,  Intel®  Core™  Microarchitecture,  It's  the  future. 

Learn  more  at  intel.com/xeon 

•Performance  measured  using  SPEGnTVare_ba5e2000  and  SPECinr*_rate_base2000/SvsWatt,  comparing  a  Dual-Core  Intel’  Xeon*  processor  5160-based  platform  tc  an  AMO  Opteccn*  processor  model  285-based  platform. 
Performance  also  measured  by  other  leading  performance  benchmarks  and  compared  to  leading  published  competitive  results.  Actual  performance  may  vary  See  http^/www.inte!.com/xeon  for  more  information 
©2005  Intel  Corporation  Intel,  the  Intel  logo,  Xeon.  Xeon  inside.  Intel  Leap  ahead ,  and  the  Intel  Leap  ahead  logo  are  trademarks  or  registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the  United  States  and  other 
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FROM  THE  CEO 


Batting  Practice 

In  business,  hitting  .300  doesn’t  get  you  into  the  Hall  of  Fame 

In  baseball,  if  you  fail  to  get  a  hit  seven  out  of  10 
times,  that’s  a  .300  average  and  you’re  regarded  as 
a  top  performer.  But  CIOs  don’t  play  baseball.  They 
play  the  game  of  business,  and  failing  seven  out  of  10 
times  is  not  only  embarrassing,  it’s  unacceptable. 

That’s  why  I  took  a  hard  look  at  some  of  the  star¬ 
tling  statistics  that  CIO  has  uncovered  over  the  past 
few  issues.  In  “When  Failure  Is  Not  an  Option”  (www. 
cio.  com/060106),  we  cited  a  biennial  study  by  the 
Standish  Group  reporting  that  just  29  percent  of  IT 
projects  conducted  in  2004  were  completed  on  time,  on  budget,  and  with  all  features 
and  functions  originally  specified.  In  “Federal  IT  Flunks  Out”  ( www. cio. com/051506 ), 
we  identified  a  minimum  of  eight  government  projects  that  either  have  failed  already 
or  seem  about  to  do  so.  And  the  government  has  already  spent  more  than  $12  billion 
on  these  projects! 

Trust  me  when  I  say  that  I  am  the  CIO’s  biggest  champion  and  understand  that 
it’s  not  always  (or  even  often)  the  CIO’s  fault  when  projects  fail  or  go  substantially 
over  budget.  But  as  CIOs  begin  to  lead  growth  initiatives  for  their  businesses,  it’s 
imperative  that  they  build  trust  with  their  CXO  peers.  Hitting  .300  in  today’s  busi¬ 
ness  world  just  ain’t  going  to  cut  it,  and  it  will  certainly  not  get  you  into  anyone’s 
Hall  of  Fame. 

How  can  projects  get  so  out  of  control?  How  can  so  many  projects  fail?  Is  it  the 
system,  the  talent,  the  expectations?  I  would  love  to  hear  your  thoughts  because  the 
only  way  that  CIOs  will  ultimately  get  the  respect  they  deserve  is  when  they  can 
stand  tall  and  deliver  on  their  promises. 


Michael  Friedenberg,  President  and  CEO 

mfriedenberg@cio.com 
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Samsung  i830 


Veri  Onwireless 


Wireless  connectivity. 
Around  town  or  around  the  world. 


•  GlobalEmail — use  the  Samsung  i830  to  access  corporate  and  personal  email  and  attachments  in  over  50  countries. 

•  Global  Phone — the  Motorola  a840  and  Samsung  a795  let  you  use  one  phone  with  one  number  so  you  can  talk  in  the 
U  S.  as  well  as  in  over  1 40  countries  worldwide. 

•  GlobalAccess — with  one  domestic  Verizon  Wireless  PC  Card  and  one  Global  PC  Card,  give  your  notebook  a  high-speed 
wireless  data  connection  here  and  abroad. 


See  verizonwirdess.com/be5tnetwork  for  network  cfa jm  details.  Subject  to  Customer  or  Corporate  Agreement,  Calling  Plan  and  Global  Phone,  Global  Email  and  Global  Access  terms  and 
conditions.  Verizon  Wireless  CDMA/GSIVi  device  with  compatible  SIM  card  required..  See  VZGIobal  brochure  for  rates,  terms  and  conditions. 
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Age  Matters 

I  suffered  almost  the  exact  experience 
that  Sheleen  Quish  describes  in  the  May 
15  story  “The  New  Glass  Ceiling.”  I  was  in 
a  top  technology  management  position  for 
15  years  but  found  myself  looking  for  a  new 
employer  at  the  age  of  50  after  my  company 
was  acquired.  I  had  never  been  out  of  work 
for  more  than  two  months  in  the  span  of  30 
years,  so  I  wasn’t  too  concerned.  I  spent  the 
next  two  and  a  half  years  looking  for  work. 
I  have  a  bachelor’s  in  accounting,  a  master’s 
in  management  information  systems,  and 
rock-solid  business  and  technology  expe¬ 
rience.  I  did  limited  consulting  to  survive 
and  tapped  retirement  money  to  keep  the 
wolves  away.  Eventually  I  took  a  job  with 
a  salary  I  had  12  years  ago,  but  I  am  happy 
to  be  able  to  pay  my  bills. 

During  my  search,  I  found  myself  com¬ 
peting  with  huge  numbers  of  senior  IT  peo¬ 
ple  in  the  same  situation.  After  15  years  of 
industry  consolidation,  there  are  just  fewer 
places  to  work.  But  I  believe  the  biggest  rea¬ 
son  I  found  it  difficult  to  find  a  job  is  age  dis¬ 
crimination.  I  would  say  that  if  you  are  40 
or  older  in  an  IT  profession,  you  are  at  risk 
of  losing  your  position.  Why?  First,  because 
many  companies  believe  that  younger  pro¬ 
fessionals  are  more  up-to-date  in  technical 


skills.  And  the  second  reason  is  self-insured 
health  insurance.  Self-insured  companies 
don’t  want  the  perceived  risk  an  older  pro¬ 
fessional  may  bring. 

The  government  used  to  protect  its  con¬ 
stituency  from  unfair  practices  but  not 
today.  I  guess  it  costs  too  much. 

DALE  ROBERT  DURBIN 

When  I  left  EDS  with  an  early  retirement 
package  in  late  1999,  my  next  position  was 
already  secure.  But  when  the  division  I  was 
with  sold  two  years  later,  I  had  to  reenter 
the  job  market  for  real,  this  time  at  age  58. 
Knowing  that  my  age  might  be  a  deciding 
factor,  I  approached  each  career  opportu¬ 
nity  on  the  basis  of  my  skills  and  how  well 
they  applied  to  the  role,  and  I  did  my  best 
to  take  the  corporate  temperature  to  see  if  I 
would  fit  in.  My  mind-set  has  been  that  if  a 
company  does  not  value  what  I  bring  to  the 
table  because  of  my  age  then  it’s  not  a  good 
place  to  be  anyway.  After  several  interim 
positions  for  more  than  four  years,  I  am 
pleased  to  report  that  at  the  ripe  young  age 
of  63, 1  have  a  great  business  development 
role  with  a  company  that  actually  appre¬ 
ciates  the  gray  hair  and  experience.  So,  I 
believe  there  is  hope  for  all  of  us  who  might 
face  age  bias,  provided  we  have  the  right 
attitude  and,  of  course,  perseverance. 
PETER  BENNETT 

IT,  aerospace  and  several  other  indus¬ 
tries  have  traditionally  discriminated 
against  older  workers.  A  friend  of  mine, 
for  example,  along  with  thousands  of  other 
workers,  was  laid  off  from  a  large  military/ 
aerospace  contractor.  All  were  on  the  verge 
of  hitting  their  20-year  mark  and  could 
have  applied  for  partial  retirement.  What 
a  coincidence!  Eventually  he  got  a  settle¬ 
ment  from  a  class-action  lawsuit,  but  not 
before  losing  his  house  and  being  emotion¬ 
ally  devastated. 


I  currently  work  for  a  smaller  company 
that  values  all  employees  regardless  of 
age.  In  building  the  IT  department  we  con¬ 
sciously  look  for  a  good  mix  of  ages.  The 
younger  ones  bring  energy  and  new  ideas, 
while  older  workers  have  experience  and 
stability.  Too  bad  larger  companies  only 
look  at  one  number  when  hiring  and  firing. 
They  are  only  hurting  themselves. 

PEDRO  LOPEZ 

I  too  took  a  job  in  2000  with  the  goal  of 
revamping  the  company’s  smaller  IT  shop, 
with  great  success.  Yet  I  still  seem  to  have 
“lost  my  endorsement.”  While  I  kept  my 
position  and  title,  a  change  in  reporting  effec¬ 
tively  moved  me  down  one  level  in  the  com¬ 
pany.  All  of  a  sudden  I  am  the  odd  man  out. 
Not  only  are  my  opinions  no  longer  solicited, 
they  aren’t  even  welcomed. 

For  six  months  now  I’ve  applied,  inter¬ 
viewed  and  felt  the  sting  of  rejection.  If  I  hear 
“we  decided  to  go  in  a  different  direction”  one 
more  time  I  just  might  climb  a  water  tower.  I 
too  am  open  to  relocation,  even  at  my  own 
expense.  I  continue  to  hang  in  there— one 
has  to  earn  after  all.  However,  it  is  an 
uncomfortable  environment  at  best.  Per¬ 
haps  the  problem  with  those  of  us  who  are 
50-plus  is  that  our  salaries  are  too  high 
compared  with  the  generation  behind 
us.  We  may  have  the  depth  of  experience, 
but  we  aren’t  the  cheapest  resource  on  the 
shelf.  In  these  days  of  the  bottom  line  being 
all  that  matters,  are  we  simply  no  longer 
viable  resources  because  of  our  cost? 
STEVE HERBORN 


What  Do  You  Think? 


Send  your  thoughts  and  feedback  to  letters@ 
cio.com.  Letters  may  be  edited  for  length  or 
clarity.  For  a  link  to  the  articles  mentioned,  go 

to  www.cio.com/archive. 
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Fujitsu  PRIMEQUEST™  Servers  with  Intel®  Itanium®  2  Processors ♦ 

Mainframe  Reliability .  Sized  for  the  Mainstream . 


For  decades,  CIOs  have  trusted 
Fujitsu  mainframes  to  run  their  mission- 
critical  applications.  Now  you  can 
get  the  same  robust  engineering  and 
innovative  design  with  the  highly  reliable, 
high  performance  Fujitsu  PRIMEQUEST 
servers  featuring  Intel®  Itanium®  2  Processors. 
Designed  for  Microsoft®  Windows®  and 
Linux®  environments  to  run  mission  critical 


System  Mirror 

PRIMEQUEST  servers  offer  the  ability  to  run 
memory  and  crossbars  as  mirrored  pairs.  This 
option,  enabled  via  the  Dual  Synchronous 
Architecture  in  PRIMEQUEST  servers,  provides 
fault  immunity  for  the  hosted  operating  system 
and  applications.  The  use  of  System  Mirror 
transparently  guards  against  hardware  errors 
that  could  otherwise  cause  a  system  panic. 


applications,  PRIMEQUEST  servers 
harness  the  power  and  performance 
of  up  to  32  Intel®  Itanium®  2  Processors, 
to  easily  accommodate  your  largest 
applications.They  are  designed  with  integrated 
networking  and  management  features  for 
simplicity  and  offer  flexible  I/O  and  partitioning 
that  enhances  your  agility  to  respond  to 
dynamic  business  requirements. 


To  learn  more  about  how  Fujitsu  PRIMEQUEST  servers  bring  mainframe  reliability  to  mainstream  environments, 


visitus.fujitsu.com/computers/PRIMEQUEST  or  call  1-800-83  1-3 1 83. 


FujlTSU 

THE  POSSIBILITIES  ARE  INFINITE 


Itanium*  2 
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YOUR  JOB  IS  TO  KEEP  SYSTEMS  AND  APPLICATIONS  RUNNING. 
OUR  MISSION  IS  TO  KEEP  PEOPLE  AND  INFORMATION  CONNECTED. 

LET’S  WORK  TOGETHER. 


Continuous  access  to  information  no  matter  what.  That’s 
Information  Availability.  It’s  what  your  employees,  suppliers 
and  customers  demand  every  minute  of  every  day.  But  to 
deliver  it  flawlessly,  you  need  a  massive  global  infrastructure, 
redundant  systems  and  diverse  networks  being  monitored  and 
supported  by  skilled  technical  experts  at  secure  facilities. 
That’s  exactly  what  SunGard  provides. 

As  a  result,  we  can  offer  you  a  higher  level  of  availability  and 
save  your  company,  on  average,  25%*  versus  building  the 
infrastructure  yourself.  Plus,  it’s  a  vendor  neutral  solution  that 
lets  you  control  your  data,  applications  and  network  while 
giving  you  the  flexibility  to  adjust  to  the  changing  needs  of  your 
business.  But  best  of  all,  it  lets  you  spend  more  time  solving 
business  problems  and  less  time  solving  technical  problems. 


For  years,  companies  around  the  world  have  turned  to  SunGard 
to  restore  their  systems  when  something  went  wrong.  So,  it’s  not 
surprising  that  they’re  now  turning  to  us  to  mitigate  risk  and 
make  sure  they  never  go  down  in  the  first  place. 

You  want  your  network  and  systems  to  always  be  up  and  running.  We 
want  the  same  thing.  Let’s  get  together.  To  learn  more,  contact  us  at 
1-800-468-7483  or  go  to  www.availability.sungard.com/masteria  and 
get  your  free  copy  of  the  book  “Mastering  Information  Availability.” 

SUNGARD9 

Availability  Services  Connected 1™ 

'Potential  savings  based  on  IDC  White  Paper,  Ensuring  Information  Availability:  Aligning  Customer 
Needs  with  an  Optimal  Investment  Strategy. 
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Whom  Do 
You  Trust? 


Most  Trusted  Countries 


privacy  When  it  comes  to  Americans’  feelings  about  offshor¬ 
ing  personal  data,  much  depends  on  the  type  of  information  and 
where  it’s  being  sent,  according  to  a  recent  survey  by  the  Ponemon 
Institute.  “Anecdotally,  people  seem  to  have  pretty  mixed  feelings. 
You  talk  to  one  person  and  they  say  they  hate  the  idea  of  sending 
their  personal  information  offshore;  another  person  will  say  it 

doesn’t  make  a  difference  to  them  at  all,” 
says  Larry  Ponemon,  who  conducted  the 
survey  of  more  than  1,200  Americans. 
“This  research  is  empirical  validation  that 
the  public  has  mixed  feelings.” 

When  asked  about  an  American  com¬ 
pany  sending  basic  information  such  as 
name,  address  or  phone  number  to  another 
country,  only  42  percent  of  the  survey’s 
respondents  were  opposed  to  the  idea.  But 
as  the  nature  of  the  data  going  offshore 
became  more  sensitive,  so  did  respondents: 
64  percent  did  not  want  employee  records 
offshored;  69  percent  were  opposed  to 
credit  card  infor-  Continued  on  Page  16 


Canada 

Ireland 

India 

Wales 

Germany 

Least  Trusted  Countries 

Philippines 
Mexico 
Haiti 
Russia 
Saudi  Arabia 


Distance  Makes  the 
Heart  (and  Mind) 
Grow  Suspicious 


THE  BEST 
WAY  TO 
SPEND 
YOUR 

SECURITY 

MONEY 


budgets  Protecting 
your  network  against  spam 
and  viruses  may  not  be  the 
best  use  of  your  limited 
security  budget,  according 
to  researchers  from  Florida 
Atlantic  University. 

The  researchers 
developed  an  economic 
model  for  how  companies 
can  evaluate  their  vulner¬ 
abilities,  analyze  their  risk 
and  calculate  the  potential 
for  damage.  They  concluded 
that  with  limited  resources, 


shoring  up  defenses  against 
the  type  of  attack  that  is 
likely  to  cause  the  greatest 
loss  may  be  the  most  pru¬ 
dent  path.  Targeted  attacks 
have  generally  been  shown 
to  cause  more  financial 
damage  than  distributed 
attacks  such  as  spam  and 
viruses. 

“This  whole  model  is 
based  on  the  principal  of 
minimizing  a  security  risk," 
says  C.  Derrick  Huang, 
assistant  professor  at 


Florida  Atlantic. 

Huang  and  professor 
Qing  Hu  were  scheduled 
to  present  their  case  last 
month  during  the  Work¬ 
shop  on  the  Economics  of 
Information  Security  at  the 
University  of  Cambridge  in 
England.  Fora  linkto their 
paper,  "Economics  of  Infor¬ 
mation  Security  Investment 
in  the  Case  of  Simultaneous 
Attacks,”  go  to  www.cio.com 
/071506. 

-Jeremy  Kirk 
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TRENDLINES 


Philly  Says  Yes  to 

Wi-Fi 

update  Philadelphia 
CIO  Dianah  Neff  sees 
green  lights  ahead  for  the 
city’s  high-speed  wire¬ 
less  project,  which  was 
approved  by  the  city  counci  I 
on  May  11.  The  citywide  network, 
designed  to  cover  135  square  miles,  was  set  to 
begin  construction  in  June  and  should  finish  test¬ 
ing  in  a  15-square-mile  trial  zone  in  September. 

If  the  technology  performs  as  promised,  a 
full  rollout  will  take  place  over  the  following 
nine  to  12  months,  Neff  says.  The  result  will 
be  both  a  Wi-Fi  infrastructure  from  Tropos 
Networks  for  1Mbps  residential  service  and  a 
Canopy  mesh  network  from  Motorola,  allow¬ 
ing  users  connectivity  across  a  wide  area. 

City  council  approval  was  the  last  major 
hurdle  for  the  controversial  network.  Simi¬ 
lar  projects  nationwide  are  being  fought 
by  large  cable  and  telecom  providers  (for 
more  details,  see  “Wi-Fight,”  www.cio. 
com/040106 ). 

Within  five  years,  the  city  expects 
20  percent  of  local  businesses  with  less 
than  10  employees  (about  2,600  companies) 
to  subscribe  to  the  T-l  service.  The  wire¬ 
less  project  was  not  designed  with  large 
enterprises  in  mind,  Neff  says. 

EarthLink  will  build  and  own  the  network, 
offering  its  own  Internet  access  service 
and  also  selling  access  wholesale  to  other 
Internet  service  providers.  The  city  will  pay 
nothing  and  receive  right-of-way  fees  as  well 
as  some  free  accounts  for  official  use.  A  non¬ 
profit  group,  Wireless  Philadelphia,  will  over¬ 
see  EarthLink's  operation  of  the  network. 

The  regular  price  of  the  residential  Wi-Fi 
service  should  be  around  $20  per  month. 
Meanwhile,  EarthLink  and  the  city  are  working 
to  set  a  subsidized  price  for  low-income  resi¬ 
dents,  estimated  at  about  $10  a  month.  Prices 
have  not  yet  been  set  for  the  T-l  service. 

A  large  part  of  the  motivation  behind  the 
project  is  to  bring  broadband  to  residents 
who  can’t  afford  it  and  small  businesses  in 
areas  where  existing  high-speed  services  are 
hard  to  get,  Neff  adds. 

-Stephen  Lawson 
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mation  leaving  our  shores;  74  percent  were  against  sending  banking 
data  abroad;  and  a  whopping  83  percent  didn’t  want  their  health 
records  leaving  the  country.  (See  “Degrees  of  Touchiness,”  this  page.) 

Where  the  information  is  going  is  as  important  as  what  it  is. 
Canada,  Ireland,  India  and  Wales  received  the  highest  overall  trust 
rankings  out  of  a  total  of  47  countries.  (For  more  on  the  pros  and 
cons  of  outsourcing  around  the  world,  see  “Global  Outsourcing 
Guide  2006,”  Page  64.)  “I  was  surprised  about  India.  I  expected 
people  to  say  it’s  a  developing  economy  and  could  be  dangerous, 
especially  with  some  publicized  incidents  of  data  exposure  and  theft 
there,”  says  Ponemon.  “Yet,  we  found  that  most  people  felt  pretty 
comfortable  with  information  being  sent  there.  They  have  a  track 
record;  they’re  an  English-speaking  culture  that,  for  the  most  part, 
seems  dedicated  to  good  security.”  At  the  bottom  of  the  trust  index 
were  the  Philippines,  Mexico,  Haiti  and  Russia.  Political  unrest 
both  in  the  Philippines  (a  large  call  center  location)  and  Haiti  may 
have  tarnished  the  image  of  those  countries,  says  Ponemon.  Russia’s 
well-known  high  piracy  rates  and  the  recent  publicity  surrounding 
Mexico’s  border  security  may  have  triggered  negative  feelings  about 
data  traveling  to  those  nations,  Ponemon  posits. 

The  bottom  line  for  CIOs?  Factor  the  cost  of  public  concern 
into  your  ROI  when  making  a  business  case  for  offshoring. 
Although  only  9  percent  of  respondents  would  pay  more  to 
ensure  that  their  personal  information  was  not  sent  offshore,  the 


Degrees  of  Touchiness 

As  the  type  of  personal  information  grows  more  intimate, 
the  percentage  of  people  who  want  to  keep  it  at  home  rises 


Basic  personal  information  (name,  address,  phone  number)  42% 

Social  Security  number  or  driver’s  license  number  51% 

Major  purchases  56% 

Internet  behavior  62% 

Employee  records  64% 

Credit  or  debit  card  number  69% 

Banking  or  home  mortgage  records  74% 

Patient  health  records  83% 

SOURCE:  Ponemon  Institute 


impact  of  an  actual  security  breach  could  be  costly.  “If  you  have 
a  privacy  meltdown,  and,  oh,  by  the  way,  it  happened  in  the  Phil¬ 
ippines,  watch  out.  It  can  be  a  pretty  large  cost,”  says  Ponemon. 
“You’ll  need  to  do  a  lot  more  explaining  up  front  if  you  choose  to 
send  data  to  a  country  that  people  deem  dangerous.  Factor  trust 
into  the  equation.” 

-Stephanie  Overby 
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automation  &  control  •  building  technologies  •  energy  &  power  •  financial  services  •  hearing  solutions  •  home  appliances  •  information  &  communication 
lighting  •  material  handling  •  medical  solutions  •  transportation  •  water  technologies  usa.siemens.com 


Who  is  accelerating  the  diagnosis 

of  heart  disease? 


SIEMENS 

Global  network  of  innovation 


m . 


V'v 


Innovations  from  Siemens  can  be  found  everywhere.  Our  breakthroughs 
•  in  healthcare  technologies  are  setting  new  standards  in  the  diagnosis  and 
treatment  of  cardiovascular  disease,  which  affects  over  71  million  adults 
in  the  US*  Siemens’  SOMATOM®  Definition  is  the  world's  first  dual-source  CT  scanner,  enabling 
doctors  to  acquire  enhanced  cardiac  images  from  virtually  every  heartbeat.  This  means  more 
accurate  diagnosis,  which  can  lead  to  better  patient  care.  At  Siemens,  our  innovations 
help  turn  dreams  into  reality. 


We  are 


To  learn  more  about  how  Siemens  is  improving  patient  care,  visit  usa.siemens.com/heartview 


TRENDLINES 


China's  | 

Future  as  a  I 

Business  I 

Incubator 

innovation  Developing  a  killer  application 
takes  more  than  just  a  network.  You  need  entrepreneurs 
able  to  develop  cutting-edge  technologies  who  also  pos¬ 
sess  the  wherewithal  and  skill  to  take  them  to  market. 

No  one  doubts  China's  ability  to  do  the  former;  that 
is  the  reason  why  many  in  the  United  States  view  China 
as  an  economic  threat.  But  the  latter  will  be  China’s 
greatest  challenge,  according  to  several  current  Chi¬ 
nese  entrepreneurs,  and  why  it  may  take  a  generation 
for  China  to  become  an  innovation  powerhouse. 

Independent  businesses  are  still  a  new  concept 
in  China,  and  until  recently  there  was  institutional 
resistance  to  entrepreneurial  startups.  Students  who 
left  school  to  pursue  a  business  idea  were  not  allowed 
to  come  back  to  finish  their  degrees  if  the  business 
failed.  There  was  scarce  venture  capital  money  to  start 
a  company,  and  China's  business  school  professors 
had  little  or  no  real-world  experience. 

Kevin  Hu  developed  software  to  fund  his  blogging 
and  social  networking  site  Yimudi.  He  is  now  seeking 
venture  funding,  but  had  to  figure  out  for  himself  how  to 
approach  potential  investors.  “I  don’t  really  care  about 
the  finance.  But  now  [my  job]  is  all  about  cash  flow  and 
the  P&L,"  he  says. 

But  more  support  is  starting  to  emerge.  Chinese 
universities  now  encourage  students  to  market  their 
creations,  and  the  government  provides  startups  with 
incubator  space.  But  because  these  changes  are  recent, 
there  aren’t  many  CEOs  who  can  help  an  aspiring 
entrepreneur  turn  a  product  into  a  business. 

The  result  is  that  the  current  crop  of  entrepreneurs 
will  succeed  or  fail  through  trial  and  error.  Jason  Tian, 

CEO  of  Baihe,  an  online  dating  service,  says  today’s 
entrepreneurs  will  convey  the  lessons  they  learn  to  the 
next  generation.  Only  then  will  Chinese  innovations 
become  commonplace.  (To  learn  about  China’s  play  to 
control  the  future  of  the  Internet,  turn  to  "China  Builds 
a  Better  Internet,"  Page  42.)  -Ben  Worthen 


Should  the  Feds  Say 
No  to  Lenovo? 


global  manufacturing  First  it  was  the  Dubai  Ports  World 
deal.  Now  it’s  Chinese  computers.  The  State  Department  recently  decided 
not  to  use  Lenovo  Group  computers  on  a  classified  network  because  of 
concerns  about  the  company’s  ties  to  the  Chinese  government. 

According  to  computer  security  experts,  however,  the  State  Depart¬ 
ment's  decision  shows  a  lack  of  understanding  about  the  global  nature 
of  PC  manufacturing.  Most  U.S.  computer  makers  use  overseas  manu¬ 
facturing  plants,  notes  James  Mulvenon,  a  Chinese  computer  warfare 
expert  with  the  Center  for  Intelligence  Research  and  Analysis.  It’s  nearly 
impossible  to  make  a  computer  without  using  foreign-made  parts. 

The  State  Department’s  decision  comes  after  Rep.  Frank  Wolf 
(R-Va.)  objected  to  the  use  of  about  900  computers  made  by  Lenovo 
on  a  classified  network  that  connects  American  embassies  and  consul¬ 
ates.  Now,  the  State  Department  says  it  will  use  Lenovo  computers 
only  in  unclassified  settings. 

“I  was  deeply  troubled  to  learn  that  the  new  computers  were  pur¬ 
chased  from  a  China-based  company,”  says  Wolf,  chairman  of  the  House 
Appropriations  Subcommittee  on  Commerce,  Justice,  State  and  the 
Judiciary.  "This  decision  would  have  had  dire  consequences  for  our 
national  security,  potentially  jeopardizing  our  investment  in  a  secure  IT 
infrastructure.  It  is  no  secret  that  the  United  States  is  a  principal  target 
of  Chinese  intelligence  services.”  Lenovo  is  partly  owned  by  the  Chinese 
Academy  of  Sciences,  an  arm  of  the  Chinese  government,  but  the  com¬ 
pany’s  headquarters  are  in  the  United  States. 

It  would  be  relatively  easy  for  spies  to  get  jobs  with  computer  mak¬ 
ers  regardless  of  where  a  company  is  based,  says  Alan  Paller,  research 
director  at  the  SANS  Institute.  Instead  of  focusing  on  where  comput¬ 
ers  are  manufactured,  he  says,  the  government  should  work  on  better 
security  for  its  systems  after  they  are  purchased.  “We  need  to  do  a  much 
better  job  of  looking  for  hidden  back  doors  in  systems,”  Paller  says. 

Last  year,  the  federal  government  conducted  a  review  of  Lenovo’s 
purchase  of  IBM’s  PC  business  and  eventually  approved  the  deal.  But  in 
April,  members  of  the  government’s  U.S. -China  Economic  and  Security 
Review  Committee  raised  objections  to  using  the  Lenovo  computers  in 
the  classified  network.  -Grant  Gross 
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MICROSOFT.COM/SECURITY/IT 


Find  tools  and  guidance  to  defend  your  network  at  microsoft.com/security/IT 

Free  Tools  and  Updates:  Streamline  patch  management  ►  Antivirus  for  Exchange:  Download  a  free  trial  of  Antigen'  for 
with  automated  tools  like  Windows  Server  Update  Services.  Exchange  and  arm  your  e-mail  server  with  powerful  multi-engine 
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And  verify  that  your  systems  are  configured  for  maximized 
security  with  Microsoft"  Baseline  Security  Analyzer. 

►  Microsoft  Security  Assessment  Tool:  Complete  this 
free,  online  self-assessment  to  evaluate  your  organization's 
security  practices  and  identify  areas  for  improvement. 


protection  from  viruses,  worms,  and  inappropriate  content. 

Learning  Paths  for  Security: Take  advantage  of  in-depth 
online  training  tools  and  security  expert  webcasts  organized 
around  your  specific  needs.  Then  test  your  security  solutions 
in  virtual  labs,  all  available  on  TechNet. 


Microsoft 


<©  200S  Microsoft  Corporation.  All  rights  reserved.  Microsoft,  Antigen,  and  Windows  Server  are  either 
registered  trademarks  or  trademarks  of  Microsoft  Corporation  in  the  United  States  and/or  other  countries. 


TRENDLINES 


1.  The  newspaper  test.  Which  plan  of 
action  for  dealing  with  a  problem  is  going  to 
work  best  if  it's  going  to  appear  on  the  front 
page  of  your  local  paper  tomorrow?  “That’s  a 
way  of  picking  up  on  all  the  consequences  of 
your  act,”  Badaracco  says. 

2.  The  Golden  Rule  test.  “There  are  a  lot 
of  different  groups  who  believe  that  they 
have  the  right  to  have  corporate  officers  and 
companies  obey  the  law.  There  are  the  vast 
majority  of  people  in  most  organizations 
who  believe  they  have  the  right  to  be  treated 
fairly  and  honestly  by  the  people  they’re 
working  for.  And  there  are  the  owners  of  a 


How  to  Make  a  TOUGH 


leadership  Sometimes  there  can  be  more  than  one  right  answer  to  a  problem. 

The  option  you  choose  can  say  a  lot  about  the  values  of  your  company— and  your  leadership. 
Joseph  Badaracco,  the  John  Shad  Professor  of  Business  Ethics  at  Harvard  Business  School, 
offers  three  simple  (and  quick)  tests  to  help  you  make  a  tough  decision.  (Download  a  podcast 
of  the  full  interview  with  Badaracco  at  www.cio.com/podcasts/leadership.html .) 


business  who  have  a  right  to  stable,  grow¬ 
ing,  risk-adjusted,  legal  returns,”  Badaracco 
says.  “The  Native  American  advice  is  to  walk 
a  mile  in  another  person’s  shoes.  That’s  a 
way  of  picking  up  on  other  people's  rights 
that  you  may  be  overlooking,  because  you’re 
under  pressure  to  get  a  decision  done.” 


3.  The  best-friend  test.  “Ask  yourself  how 
you  would  like  somebody  who  knows  you 
well,  and  whose  respect  matters  to  you,  to 
think  about  your  decision,"  he  says.  “That's 
a  way  of  putting  a  spotlight  on  your  charac¬ 
ter  [and]  the  character  of  the  organization 
you’re  trying  to  shape.”  -David  Rosenbau 


The  Art  of  Competition 

Gettingthebest  of  your  rivals  requires  understanding  what  they’re  up  to 


book  review  One  of 

the  biggest  challenges  manag¬ 
ers  face  is  figuring  out  what  the 
competition  is  up  to,  according 
to  Leonard  Fuld,  a  consultant 
on  competitive  intelligence. 

In  his  new  book,  The  Secret 
Language  of  Competitive  Intel¬ 
ligence,  Fuld  explains  how  to 
analyze  information  about  the 
competition  to  obtain  insight 
and  advantage  over  rivals. 

Fuld  contends  that  the  infor¬ 
mation  one  needs  to  stay  ahead 
of  competitors  is  everywhere. 
Competitors  reveal  more 
information  now  than  ever 
before,  through  online  archives 
of  their  annual  reports,  press 
releases  and  PowerPoints 
detailing  company  strategy. 

But  while  the  Web  contains  lots 


of  intelligence  gems,  it  is  also  a 
source  of  misinformation  and 
confusion.  The  key  to  develop¬ 
ing  insight  into  one’s  rivals  is 
knowing  how  to  use  the  data 
you  find.  Transforming  infor¬ 
mation  into  intelligence  is  an 
art  form,  says  Fuld,  involving 
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creativity,  critical  thinking— 
and  prompt  action  once  you’ve 
obtained  a  worthwhile  insight. 

One  way  to  turn  informa¬ 
tion  into  intelligence  is  by 
developing  scenarios  in  which 
you  imagine  what  your  com¬ 
pany  might  do  in  response  to 
its  rivals.  Fuld  provides  exam¬ 
ples  of  how  companies  can 
use  competitive  intelligence 
both  offensively  and  defen¬ 
sively.  Google,  for  example, 
needs  to  be  prepared  for  how 
Microsoft  might  react  to  what 


it  does,  because  now  that 
Google  is  a  public  company, 
Microsoft  and  other  rivals 
have  greater  access  to  infor¬ 
mation  about  its  intentions. 

Finally,  he  advises,  compa¬ 
nies  need  to  have  more  than 
one  strategy  for  each  action 
they  anticipate  rivals  will  take. 
Using  competitive  intelligence 
effectively  means  more  than 
guessing  what  your  rivals  will 
do;  it  means  being  prepared 
for  what  they  might  do. 

-Katherine  Walsh 


[The  Secret  Language  of  Competitive  Intelligence:  How  to  See 
Through  &  Stay  Ahead  of  Business  Disruptions,  Distortions, 
Rumors  &  Smoke  Screens 

By  Leonard  M.  Fuld 

Crown  Business,  2006,  $24.95 
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WHY  ARE  SO  FEW  USING  IT? 


YOU  NEEI '  Bl  WITH  A  HIGHER  IQ 

information  Builders  powers  the  largest  business  intelligence  deployments  in  the  world.  All  of 
your  employees-not  just  managers  and  analysts-need  to  make  quick  and  informed  decisions. 
That's  why  we  pioneered  Operational  Bl-to  deliver  intelligence  directly  to  all  of  the  people  and 
processes  that  need  it,  inside  and  outside  the  enterprise.  Our  WebFOCUS  software  offers 
superior  integration,  scalability  and  usability.  Add  in  years  of  experience  and  it's  no  wonder  our 
customers  save  millions  using  business  intelligence.  Make  the  smart  move  and  call  for  your 
FREE  Bl  Best  Practices  Assessment  at  1.800.969.INFO  or  visit  www.informationbuilders.com 


Information 

Builders 


The  Standard  for 
Enterprise 
Business 
Intelligence 
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Failingto  Heed  VoIP’s  Call 

Many  companies  are  missing  voice  over  IP’s  cost  savings 


lightly  more  than  half  of  compa¬ 
nies  surveyed  are  considering,  or 
are  in  the  process  of  deploying, 
voice  over  IP  (VoIP)  technology,  accord- 
ingtothe  Cutter  Consortium,  which  con¬ 
ducted  the  survey  of  132  organizations. 
But  44  percent  reported  that  it  wasn't 
even  on  their  radar. 

The  findings  are  unexpected,  says  Lou 
Mazzucchelli,  a  fellow  of  the  Cutter  Busi¬ 
ness  Technology  Council.  Mazzucchelli 
thinks  many  companies  are  being  short¬ 
sighted.  The  major  telecommunications 
companies  are  going  to  start  offering  VoIP 
services,  and  eventually,  it  will  replace 
traditional  phone  service,  he  predicts. 

So  why  are  companies  turning  a  deaf 
ear  to  VoIP?  Of  those  who  said  they  were 
not  considering  the  technology,  53  percent 
cited  no  business  need  for  it.  Another  22 
percent  said  they  had  no  business  sponsor 
for  a  VoIP  project.  There  are  costs  to  VoIP, 
Mazzucchelli  acknowledges,  but  tradi¬ 
tional  telephone  service  isn’t  free  either.  In 
the  long  run,  he  notes,  VoIP  offers  substan¬ 
tial  cost  savings  over  existing  technology. 


VoIP  skeptics  often  cite  security  as  a 
reason  for  avoiding  the  technology,  but 
Mazzucchelli  believes  the  lack  of  an  ade¬ 
quate  network  infrastructure  is  a  bigger 
technical  barrier  to  adoption.  Twenty-one 
percent  of  respondents  said  they  weren’t 
looking  at  VoIP  because  their  current 
infrastructure  would  not  support  it. 

VoIP  can  be  unreliable  (it’s  vulnerable 
to  problems  such  as  dropped  calls),  so 
IT  shops  need  sufficient  staff  to  keep  an 
in-house  VoIP  system  running.  Also,  tradi¬ 
tional  telephony  providers  supply  backup 


power  during  power  outages,  but  VoIP 
users  must  provide  their  own.  Mazzuc¬ 
chelli  says  the  seriousness  of  these  barri¬ 
ers  depends  on  the  relative  importance  of 
security  and  reliability  to  a  company.  For 
example,  some  parts  of  an  organization 
could  easily  tolerate  a  power  outage.  “If 
you’re  a  utility,  you  want  your  customer 
service  line  open  during  a  disaster,”  Maz¬ 
zucchelli  observes.  “But  many  others  in 
the  company  probably  have  cell  phones 
they  could  use.”  You  have  to  ask  where  it's 
OK  to  take  a  risk  on  a  new  technology. 


Best  Practices: 


Learn  about  VoIP.  Even  if  you’re  not  planning  to  deploy  VoIP  soon,  you  should  still  stay  up  to 
speed  on  the  technology  and  adoption  trends,  advises  Mazzucchelli.  That  way,  you  won't  fall 
behind  as  competitors  deploy  VoIP  systems. 

m  Evaluate  the  pros  and  cons.  The  decisions  of  whether  to  use  VoIP  and  how  to  use  it  are  unique 
’HP  for  every  company.  Consider  the  impact  VoIP  would  have  on  network  security  and  reliability,  infra¬ 
structure,  staffing  and  telecommunications  costs.  “VoIP  is  in  its  infancy,"  Mazzucchelli  notes;  right  now, 
more  has  been  written  about  how  to  deploy  it  than  is  known  from  experience. 

■2  Go  slowly.  Don’t  convert  your  entire  voice  network  to  VoIP  at  once.  Consider  a  mix  of  traditional 
voice  services  and  VoIP  to  lower  the  risk  of  rolling  out  the  new  technology. 


A  New  Technology's  Adoption  Curve 


, 


22 


56% 

of  companies  surveyed  are 
considering  or  have  deployed  VoIP. 


Stage  of  implementation 

Vendor  research  46% 

Test  deployment  28% 

Substantial  rollout  12% 

Completed  implementation  14% 


(NOTE:  Respondents  could  select  all  that  applied.) 
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44% 

of  companies  surveyed  are  not 
lookingto  implement  VoIP. 


Reason 


53% 

No  business  need 

22% 

No  business  sponsor 

21% 

Current  system  won't  support  it 

17% 

Other 

SOURCE:  Cutter  Consortium 
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IT  For  The  Way  You  Work 


Advanced 


flfi 

IE 

HP  ProLiant  DL380  G4 

470063-705 

-  Intel®  Xeon®  Processor  (2MB  cache,  3GHz,  800MHz) 

-  Intel®  Extended  Memory  64  Technology 

-  Ultra320  SCSI 

-  Smart  Array  6i  Controller 

-  10/100/1000  Ethernet 
-3-year  warranty 
*1,499.99 


Intel®  Xeon®  Processor  Upgrade 

378748-B21 

-  Intel®  Xeon®  Processor 
(2MB  cache,  3GHz,  800MHz) 

-  Designed  for  dual-processor  server 
and  workstation  platforms 

*499.00 


Valued  at  *499 
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BUSINESS  CONTINUITY 
GOES  UNNOTICED. 
(UNTIL  IT  STOPS.) 


Simply  hoping  a  disaster  or  security  breach  won’t  happen  isn’t  good  enough.  Lack  of  business 
continuity  planning  can  have  catastrophic  implications  for  a  company.  System  unavailability 
can  skyrocket  into  millions  of  dollars  per  minute  of  downtime.  Customer  loyalty  and  regulatory 
compliance  efforts  can  also  be  compromised.  Thankfully,  Symantec  offers  technologies  and 
services  that  help  reduce  the  risk,  duration  and  frequency  of  downtime.  Even  in  the  event  of  a 
security  breach  or  power  outage.  To  find  out  more  about  how  to  help  eliminate  downtime  as 
a  threat  to  the  security  and  availability  of  your  network,  visit  www.symantec.com/datacenter 


^  Symantec 
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IT’S  SAFE  TO  SAY 

that  when  Plato  wrote 
in  The  Republic  that 
necessity  is  the  mother 
of  invention,  he  had  no 
concept  of  a  21st  cen¬ 
tury  enterprise  data  center.  If  he  had, 
he  might  have  mused  that  it’s  what 
gives  birth  to  reinvention  as  well. 

As  IT  professionals  across  the 
country  and  around  the  world  strive 
to  understand  the  promise  and  the 
challenges  of  the  next  generation  of 
information  technology,  they  recog¬ 
nize  that  nowhere  is  that  understand¬ 
ing  more  crucial  than  in  the  core  of 
their  IT  operations:  the  data  center. 

In  this  second  edition  of  the  Next- 
Gen  IT  series,  produced  jointly  by  the 
editorial  teams  of  CIO  and  Computer- 
world,  we  look  at  the  factors  driving 
what  can  very 
aptly  be  described 
as  a  reinvention 
of  the  enterprise 
data  center.  Indeed, 
that  reinvention  is 
born  of  necessity: 
the  relentless  need 
to  drive  the  business  by  cutting  costs 
and  improving  customer  service. 

It’s  clear  that  the  reinvented,  next- 
generation  data  center  will  be  a  bastion 
of  virtualization,  consolidation  and 
automation  technologies.  What  isn’t  so 
clear  is  how  best  to  address  the  dif¬ 
ficulties  —  and  even  some  anomalies 
—  inherent  in  their  implementation. 

Conventional  wisdom  suggests 
that  virtualization  enables  compa¬ 
nies  to  cut  staffing  costs,  since  there’s 
less  equipment  to  be  maintained  in 
a  virtualized  environment.  Yet  many 
CIOs  are  finding  that  those  costs  ac¬ 
tually  increase  because  the  environ¬ 
ment  is  more  complex  and  requires  a 
more  highly  skilled  staff.  Consolida¬ 
tion  by  means  of  blade  servers  may 
cut  maintenance  and  management 
expenses,  but  those  savings  can  be 
more  than  offset  by  the  cost  of  the 
energy  required  to  cool  them. 
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We  are  confident  that  our  anchor 
stories  in  this  edition  —  “Lighting 
the  Path  to  ‘Lights  Out’”  (page  4)  and 
“Management:  The  Missing  Piece  of 
the  Puzzle”  (page  12)  —  will  spark  a 
valuable  discussion  of  what  this  essen¬ 
tial  reinvention  will  entail.  Together 
with  the  balance  of  the  issue  and  ad¬ 
ditional  content  available  on  our  Web 
site  (ITNextGeneration.com),  they 
provide  an  intriguing  glimpse  into  the 
data  center  yet  to  be  fully  conceived.  ♦ 
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BY  GALEN  GRUMAN 

HE  TWIN 
PRESSURES 

of  doing  more  for 
the  business  and 
keeping  IT  costs 
down  are  forc¬ 
ing  many  CIOs  to 
rethink  their  approach  to  one  of  their 
most  critical  responsibilities  and  one  of 
their  largest  costs:  the  enterprise  data 
center.  A  joint  Computers orld/CIO 
survey  of 389  IT  executives  shows  that 
63%  are  seeking  increased  efficiency 
from  their  data  centers,  while  60%  are 
looking  to  bring  in  new  capabilities. 

“CIOs  are  seeing  that  the  econom¬ 
ics  of  yesterday’s  data  center  isn’t 
going  to  work  in  the  future,”  says 
Michelle  Bailey,  research  director  at 
IDC.  “You  can’t  have  more  people, 
more  I/O  and  more  servers  with 


VIRTUALIZATION  ON  THE  RISE 

More  than  three  quarters  of 
all  companies  with  500+  em¬ 
ployees  are  deploying  virtual  servers. 

Respondents  currently  using 
server  virtualization  technologies 
report  that  they  expect  45%  of 

new  servers  purchased  next 
year  to  be  virtualized. 

SOURCE:  IDC  2005  SURVEY 


every  new  application,”  she  says. 

New  technologies,  such  as  vir¬ 
tualization  and  automation,  hold 
significant  promise  in  changing  the 
economics  of  the  data  center,  largely 
by  reducing  both  the  labor  and  equip¬ 
ment  needed  to  be  maintained  and 
optimized.  The  next-generation 
data  center,  promoted  by  vendors 
as  “lights  out,”  moves  away  from  the 


maintenance-and-repair  model  to  the 
orchestrate-and-prevent  model.  In  the 
lights-out  data  center,  systems  largely 
manage  themselves  and  a  smaller  core 
of  IT  staff  focuses  on  improving  the 
data  center’s  ability  to  drive  innova¬ 
tion  and  enhance  the  business. 

But  adoption  of  these  next-genera¬ 
tion  technologies  introduces  archi¬ 
tectural  and  integration  challenges. 
The  technologies’  varying  levels  of 
maturity  will  require  a  staged  imple¬ 
mentation  approach  and  demand  that 
CIOs  rethink  their  data  center  staffing 
model.  “It’s  a  lot  to  bite  off,”  says  Galen 
Schreck,  a  senior  analyst  at  Forrester 
Research  Inc. 

Virtualization:  Promises 

One  new  technology  in  particular 
—  virtualization  —  can  help  CIOs 
significantly  improve  operations  and 


Here  are  some  strait 
and  managerial  coninltw 
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flexibility  in  the  data  center.  By  sepa¬ 
rating  software  from  the  hardware 
on  which  it  runs,  virtualization  can 
make  the  data  center  far  more  flex¬ 
ible  and  agile  in  five  ways: 

■  It  lets  you  treat  multiple  hard¬ 
ware  devices,  like  servers  or  storage 
systems,  as  one  device.  Conversely,  it 
allows  you  to  separate  individual  phys¬ 
ical  servers  into  multiple  virtual  ones, 
making  it  easier  to  scale  storage  and 
applications  up  or  down  upon  demand. 

■  It  permits  you  to  use  cheaper,  ge¬ 
neric  hardware  and  aggregate  it  into 
virtually  unified  systems  that  are 
more  cost-effective. 

■  Virtualization  makes  it  easier  to 
handle  equipment  failure  because  you 
can  move  a  virtual  environment  to 
other  available  hardware  quickly. 

■  By  treating  hardware  resources 
as  one  pool,  virtualization  lets  you 
use  that  equipment  more  efficiently, 
so  you  need  less  equipment. 

■  Outside  the  production  environ¬ 
ment,  virtualization  makes  it  easier 
to  set  up,  change  and  tear  down  test 
environments. 

Clothing  retailer  Coldwater  Creek 
Inc.  is  using  virtualization  to  reduce 
its  number  of  physical  servers,  lead¬ 
ing  CIO  Michael  Carper  to  predict 
that  he  will  be  able  to  “extend  the  life 
of  the  data  center  by  five  years.” 

At  Corrections  Corporation  of 
America  (CCA),  which  runs  about  60 
prisons,  virtualization  not  only  helps 
reduce  hardware  needs,  it  also  speeds 
provisioning  of  new  servers.  “It  takes 
just  hours  to  bring  in  additional  capac¬ 
ity,  not  days,”  says  CIO  Brad  Wood. 

Although  server  virtualization  tech¬ 
nology  is  advancing  rapidly,  there 
has  been  less  progress  on  the  storage 
side,  notes  Schreck.  That’s  because 
traditional  large-systems  vendors, 
such  as  EMC  Corp.  and  Hitachi  Data 
Systems  Corp.,  don’t  want  to  see  stor¬ 
age  become  commoditized,  says  John 
Webster,  senior  analyst  at  Data  Mo¬ 
bility  Group  LLC.  But  other  vendors, 
such  as  Symantec  Corp.  and  Kazeon 
Systems  Inc.,  now  offer  software  for 
heterogeneous  environments  that  can 
virtualize  generic  storage  systems 
and  interact  with  proprietary  systems. 

Virtualization:  Challenges 

Virtualization  technology  is  fairly 
new.  Consequently,  not  all  applica- 


The  skill  sets  change  dramatically. . . . 

We  have  fewer,  more  highly  talented  people. 

MICHAEL  CARPER,  CIO,  COLDWATER  CREEK  INC. 


tions  can  work  in  a  virtualized  en¬ 
vironment,  cautions  Kris  Dominick, 
president  of  data  center  consulting 
at  Data  Dimensions  Inc.  “You  need 
to  start  with  a  feasibility  assess¬ 
ment,”  he  says.  Today,  virtualization 
also  requires  a  restart  to  change  the 
environment,  so  it  won’t  work  to 
redistribute  computing  and  storage 
resources  automatically  on  the  fly. 

An  irony  of  the  virtualized  data  cen¬ 
ter  is  that  your  staffing  costs  could  in¬ 
crease  even  as  your  staffing  levels  de¬ 
crease,  says  Wood.  It  takes  more  skill 
and  experience  to  work  in  a  virtual¬ 
ized  environment  than  in  a  traditional 
one.  As  server  and  storage  capacity  is 
optimized,  your  buffer  is  diminished 
to  handle  fail-overs  and  unexpected 
loads.  Furthermore,  you  have  to  know 
what  resources  are  in  use  by  which 
applications  and  understand  which  re¬ 
sources  are  now  shared,  since  any  fail¬ 
ures  or  workload  rebalancing  can  af¬ 
fect  multiple  systems  simultaneously. 


“You  need  a  highly  skilled,  highly  paid 
staff  to  manage  this  more  complex 
environment,”  Wood  says.  “You  can’t 
have  just  the  generalist  anymore.” 

The  Computerworld/CIO  survey  bears 
this  out:  44%  of  respondents  say  they 
expect  to  need  a  more  highly  skilled 
staff  to  run  a  virtualized  data  center. 

The  adoption  of  virtualization  also 
raises  political  issues  for  CIOs.  In 
a  virtualized  data  center,  business 
units  may  no  longer  have  servers 
with  their  names  inscribed  on  them. 
“Virtualization  gets  a  lot  of  resistance 
[from  business  departments]  because 
it’s  shared  services.  People  don’t  play 
well  in  the  sandbox  together,”  IDC’s 
Bailey  notes.  “A  lot  of  people  like  to 
own  their  infrastructure.” 

Even  within  the  IT  department, 
virtualization  can  sometimes  bruise 
egos,  says  Schreck.  “Virtualization 
cuts  across  ownership  boundaries,”  he 
says,  leading  each  group  to  compete 
for  resources  and  campaign  for  its  own 
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services.  A  related  approach  to  virtu¬ 
alization  is  grid  computing,  in  which 
multiple  servers  are  joined  together  not 
as  a  single  virtual  machine,  but  as  a  co¬ 
ordinated  set  of  computational  engines, 
like  a  yoked  team  of  horses. 

Merrill  Lynch  &  Co.  has  recently 
deployed  a  grid  for  its  derivatives  busi¬ 
ness,  reducing  the  number  of  servers 
needed  to  handle  the  same  computa¬ 
tion  load.  “If  there’s  excess  capacity  in 
the  grid,  you  can  provision  it  in  min¬ 
utes,”  says  John  Cislo,  director  of 
client  infrastructure  solutions.  It 
makes  sense  to  consider  a  grid  rather 
than  virtualization  when  your  compu¬ 
tations  need  to  use  full  server  capacity 
(not  share  it  with  others)  and  handle 
lots  of  floating-point  calculations, 
which  are  common  in  engineering  and 
financial  analyses,  he  says. 

Deploying  a  grid  raises  the  same 
political  issues  that  virtualization 
raises,  notes  Cislo,  because  it,  too,  is 
a  shared  service.  And  grid  computing 
comes  with  other  issues.  One  is  the 
need  for  a  more  homogeneous  server 
environment,  which  can  be  hard  to 
maintain  as  vendors  change  their 
hardware  over  time.  Another  is  the 
need  to  deal  with  small,  less  estab¬ 
lished  vendors,  since  the  commercial 
versions  of  the  technology  are  still 
new.  Third,  setting  up  a  grid  is  expen¬ 
sive,  so  it  requires  that  you  convince 
management  that  the  investment  will 
pay  off  as  more  business  units  take 
advantage  of  the  system,  says  Brad 
Kurtzman,  director  of  equity-linked 
products,  the  first  business  group  at 
Merrill  Lynch  to  use  grid  computing. 

Automation:  Promises 

Automation  is  another  area  where  new 
technology  can  help  make  the  data 
center  more  efficient.  Imagine  that 
each  time  an  employee  is  hired,  is  pro¬ 
moted  or  leaves,  all  application  and 
network  access  systems  are  updated 
to  reflect  changes  in  permissions  or 
roles.  Or  that  as  storage  is  added  to 
the  data  center,  application  and  file 
servers,  disaster  recovery  systems  and 
storage  management  policies  adjust  to 
use  the  new  storage  capacity.  Or  that 
as  application  servers  are  added,  they 
could  simply  be  attached  to  the  net¬ 
work,  and  the  operating  system,  ap¬ 
plications  and  network  connections 
would  be  installed  automatically. 


GETTING  BIGGER 

During  the  next  three  years, 
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COSTS  AND  CAPABILITIES 

What  are  the  three  main  rea¬ 
sons  for  making  changes  to  your 
company’s  data  center  facilities? 

To  reduce  operational  costs 
through  efficiency 
and  automation 

To  bring  in  new  capabilities  or 
enlarge  its  mission  for  roughly 
the  same  overall  costs 

To  consolidate  multiple  data  centers 
for  economies  of  scale  and 
centralization 

BASE:  389  IT  executives:  respondents  could 
choose  their  top  three 

SOURCE:  EXCLUSIVE  COMPUTERWORLD/CIO  SURVEV. 
CONDUCTED  MAY  2006 


Today,  each  system  must  be  updated 
by  an  IT  staffer,  even  if  you  have  a 
centralized  management  console  ap¬ 
plication  to  simplify  the  effort. 

However,  automation  technology  is 
even  less  mature  than  virtualization, 
reports  Data  Dimension’s  Dominick. 
Although  many  automation  tools  are 
available,  they  tend  to  focus  on  spe¬ 
cific  subsystems,  requiring  IT  staffers 
to  manage  their  interactions  and  often 
develop  their  own  tools  to  integrate 
them,  says  Forrester’s  Schreck.  “You 
need  to  get  the  integration  before  you 
can  provision,”  he  says.  The  result: 
“Maybe  about  15%  of  North  American 
firms  have  started  to  make  this  transi¬ 
tion,”  Schreck  notes,  referring  to  an 
unpublished  Forrester  study.  Accord¬ 
ing  to  the  Computers orld/ CIO  survey, 
40%  or  more  of  respondents  identified 
immaturity  in  each  of  four  automa¬ 


tion-related  technologies  as  barriers 
to  achieving  a  lights-out  data  center: 
policy-based,  self-configuring  systems 
for  automated  system  adjustments; 
management  and  monitoring  tools  for 
security  and  compliance  needs;  stan¬ 
dardized  interfaces  so  management 
tools  can  work  together;  and  support 
desk  and  system  management  tools 
that  can  work  together  automatically. 

As  automation  products  improve, 
this  should  change.  “Today,  they’re 
mostly  point  tools,  but  I  see  holistic 
umbrella  tools  emerging,”  IDG’s  Bailey 
says.  “We  see  the  ramp-up  in  the  next 
18  to  24  months.”  In  the  meantime, 
enterprises  should  standardize  their 
IT  processes  using  techniques  such 
as  IT  Infrastructure  Library  and  Six 
Sigma  to  ensure  that  the  data  center 
has  the  right  processes  to  get  ready 
for  automation,  Schreck  says. 

Automation:  Challenges 

As  with  virtualization,  automation 
requires  a  more  skilled,  expensive 
IT  staff.  Troubleshooting  becomes 
exponentially  more  difficult  when 
the  server  that  has  failed  is  actually 
spread  across  several  physical  serv¬ 
ers.  And  optimizing  or  just  fixing 
problems  in  automated  systems  that 
interact  with  other  automatic  sys¬ 
tems  becomes  quite  difficult  because 
so  many  decisions  and  assumptions 
are  now  hidden  inside  the  software. 

“The  skill  sets  change  dramatically,” 
says  Coldwater’s  Carper.  He’s  had 
to  change  his  IT  staff  mix  by  hiring 
more-skilled,  process-oriented  staffers 
to  focus  on  core  systems  management 
and  automation  so  that  errors  and 
inefficiencies  don’t  ripple  throughout 
the  data  center.  He  also  has  automated 
provisioning  of  new  hardware  and 
software  wherever  possible,  so  the 
IT  staff  doesn’t  spend  nearly  as  much 
time  loading  software  onto  machines. 
For  example,  if  a  laptop  needed  to  be 
replaced,  Coldwater’s  IT  staff  would 
just  drop  off  a  new  system  to  the  user. 
All  the  user  data,  as  well  as  applications 
and  network  access  permissions,  would 
be  automatically  restored  over  the  net¬ 
work  in  an  hour  or  two.  That’s  possible 
because  Carper  invested  in  automated 
backup  and  provisioning  systems.  Af¬ 
ter  revamping  Coldwater’s  data  center 
over  the  past  two  years,  “we  have  fewer, 

CONTINUED  ON  PAGE  8 
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CIOs  Feel  the  Heat 

The  next-generation  data  center  shares  two  prob¬ 
lems  with  its  elders:  It’s  hungry,  and  it  runs  hot. 

From  the  mainframe  on,  data  center  managers 
have  struggled  with  power  and  heat.  Huge  quantities 
of  equipment  require  huge  amounts  of  power.  And 
computers  generate  significant  heat,  which  increases 
as  equipment  gets  smaller  and  denser.  And  that 
means  more  air  conditioning  and  even  more  power. 

Whether  an  enterprise  is  trying  to  free  up  real 
estate  or  trying  to  cram  more  equipment  into  a  grow¬ 
ing  company’s  existing  data  center,  the  result  is  the 
same:  more  power  needed,  more  heat  generated. 

There  aren’t  many  easy  answers  to  these  challenges. 
You  can  replace  older  equipment  with  higher-capacity, 
higher-performance  equipment  to  at  least  stem  the 
tide  of  power  usage  and  heat  emission.  You  can  place 
equipment  so  that  the  devices  that  emit  lots  of  heat 
have  greater  airflow  or  zoned  air  conditioning  around 
them.  Or  you  could  alternate  high-heat  devices  with 
low-heat  ones,  a  strategy  called  “hot  aisle/cold  aisle.” 

New  30-plus  blade  servers  generate  so  much  heat 
that  they  are  especially  difficult  to  cool,  says  John  Web¬ 
ster,  senior  analyst  at  consultancy  Data  Mobility  Group. 


Pegasus  Solutions  CIO  Mike  Kistner  had  to  use  the  hot 
aisle/cold  aisle  approach  with  his  blade  servers.  Where 
possible,  he’s  shifting  to  compute  appliances,  a  type 
of  multiprocessor  device  from  Azul  Systems  Inc.  that 
emits  much  less  heat  and  takes  less  power.  “We  save 
thousands  of  dollars  a  month  in  electricity,”  Kistner 
says.  But  the  compute  appliance  is  designed  for  Java 
applications,  so  blade  servers  are  still  needed  for  the 
majority  of  Pegasus’  enterprise  software. 

Corrections  Corporation  of  America  CIO  Brad 
Wood  built  a  new  data  center  three  years  ago,  with 
one  goal  being  to  avoid  heat  problems  through  physi¬ 
cal  design.  “But  we  still  have  hot  spots,”  he  says.  “The 
new  boxes  are  killers  for  heat.” 

In  a  return  to  the  mainframe  past,  data  centers  may 
need  to  use  water  cooling  for  the  new  generations  of 
dense,  rack-mounted  servers  and  storage  systems, 
says  Randy  Mott,  CIO  of  data  center  equipment  ven¬ 
dor  Hewlett-Packard  Co.  But  that  presents  another 
problem:  “Lots  of  people  don’t  have  the  plumbing  in 
their  data  center,”  says  IDC  analyst  Michelle  Bailey. 
“And  they  are  often  concerned  with  leaks  destroying 
the  equipment.”  So  CIOs  and  CTOs  will  have  to  keep 
their  cool  as  best  they  can. 

-  GALEN  GRUMAN 


CONTINUED  FROM  PAGE  6 

more  highly  talented  people,”  he  says. 
But  the  next-generation  data  center’s 
demand  for  a  more  highly  skilled  IT 
workforce  presents  a  staffing  risk  for 
CIOs  moving  in  that  direction. 

Consolidation 

The  third  leg  of  a  next-generation  data 
center  technology  strategy  is  consoli¬ 
dation.  Multiple  data  centers  can  elim¬ 
inate  redundancies  in  equipment,  staff 
and  telecommunications  technology. 
Consolidation  within  a  single  data 
center  —  reducing  the  range  of  equip¬ 
ment  used  and  using  higher-capacity 
equipment  —  achieves  similar  results 
by  simplifying  technology  deploy¬ 
ments  and  process  changes. 

Incremental  technology  advances, 
such  as  the  use  of  blade  servers,  dens¬ 
er  storage  and  multiprocessor  CPUs, 
have  made  it  easier  to  consolidate  data 
centers  by  increasing  capacity  in  the 
same  or  less  physical  space.  “We  get 
economies  of  scale,  with  no  additional 
management  needed,”  says  Mike  Kist¬ 
ner,  CIO  of  Pegasus  Solutions  Inc.,  a 
payments  and  reservations  service 
provider  for  hotels. 

The  maturation  of  remote  monitor¬ 


ing  and  management 
tools  lets  central  IT  staff 
manage  satellite  offices 
confidently,  notes  Data 
Dimension’s  Dominick. 

“But  be  careful  not  to  get 
too  much  physical  dis¬ 
tance  between  the  data 
center  and  the  remote 
staff,”  he  warns.  For 
example,  if  a  remote  of¬ 
fice  has  its  own  disaster 
recovery  application 
running  on  a  local  server, 
you’ll  need  to  dispatch 
someone  to  fix  it  if  it 
fails.  Remote  tools  can  handle  stan¬ 
dard  processes  and  technologies,  but 
specialty  equipment  and  software  will 
usually  require  someone  at  the  scene. 

“It’s  expensive  to  consolidate,  so 
you  need  executive  buy-in,”  CCA’s 
Wood  cautions. 

Lights  Out:  The  Vision 

Although  vendors  like  to  use  the 
phrase  “lights  out”  to  describe  the 
vision  of  future  data  centers,  a  fully 
automated,  self-adjusting  data  center 
with  no  people  (a  la  the  HAL  9000  of 
2001:  A  Space  Odyssey )  remains  more 
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fiction  than  science. 

What  will  happen  is 
that  data  centers  will 
become  increasingly 
automated  and  self¬ 
managing  as  virtualiza¬ 
tion,  automation  and 
monitoring  technologies 
mature,  letting  comput¬ 
ers  respond  to  typical 
situations  based  on 
human-created  scenar¬ 
ios.  But  people  will  still 
be  needed  to  handle  the 
unexpected  and  develop 
the  improved  processes 
and  business  applications  that  will 
keep  the  enterprise  moving  forward. 

“There’s  no  standard  framework” 
for  a  next-generation  data  center,  says 
Dominick.  So  the  CIO  still  needs  to 
figure  out  how  to  implement  still- 
evolving  technologies,  rework  and 
streamline  the  IT  processes,  and  get 
the  right  skill  mix  in  the  organization 
to  get  closer  to  that  lights-out  vision.  ♦ 


Gruman  is  principal  of  The  Zango 
Group  in  San  Francisco  and  a  regular 
contributor  to  CIO  magazine.  Contact 
him  at  ggruman@zangogroup.com. 


As  data  center  tech¬ 
nologies  shift  and  as  IT 
becomes  more  tightly 
linked  with  the  busi¬ 
ness,  skill  sets  in  the 
data  center  will  also 
evolve.  IDC  believes 
that  automation  will 
moderate  the  number  of 
systems  administrators 
required,  while  business 
analysts  will  play  an 
increasingly  important 
role 
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The  cost 
of  getting 

bigger 
just  got 
smaller. 


You  need  more  storage.  You  don't  need  more  fees  or  systems  to 
manage.  The  Pillar  Axiom™  storage  system  lets  you  add  performance 
and  capacity  over  300  TB  per  system,  without  multiple  software 
license  fees.  It  empowers  you  to  manage  data  on  multiple  tiers, 
whether  in  SAN,  NAS  or  both,  through  one  simple  user  interface. 
Because  Pillar  delivers  top-tier  performance  and  capacity,  often  for 
less  than  what  many  companies  pay  just  to  maintain  and  operate 
their  storage  systems,  it  can  really  improve  your  bottom  line. 

To  hear  about  our  new  approach  to  managing  data  storage,  you 
owe  it  to  yourself  to  schedule  a  half-hour  briefing. 

Call  1-877-252-3706  or  visit  www.pillardata.com/smaller 


©  2006  Pillar  Data  Systems  Inc.  All  rights  reserved.  Pillar  Data  Systems,  Pillar  Axiom, 
and  the  Pillar  logo  are  all  trademarks  of  Pillar  Data  Systems. 


Learn  the  truth  about  networked  storage. 


ADVERTISING  SUPPLEMENT 


The  Service-Oriented 
Enterprise  welcome  to 

the  End  of 
Business  as 
Usual 


Reduce 
complexity, 
improve 
flexibility  and 
lower  cost 


Register  to  Receive  New  SOE  Book 

Register  for  your  advance  discounted  copy  of  the 
upcoming  book  on  SOE,  The  End  of  Business  as  Usual, 
co-authored  by  Capgemini’s  Andy  Mulholland,  Intel’s 
Chris  Thomas,  and  KurMeta’s  Paul  Kurchina.  Go  to  www. 
nextgenerationinsights.com  and  sign  up  today. 


e  convergence  of  high- 
erfotfnance  computing  and 
ata  Unalysis,  global  high-speed 

unications  and  even  advanced 
ng,  the  time  is  right  to: 

mplify  IT 

•  Enable  a  tighter  mapping  of  IT  to  business  goals 

•  Reduce  IT  costs  through  reuse  of  solution 
components 

Global  organizations  must  be  clear-thinking  and 
well  informed  to  make  the  right  decisions  and  take 
advantage  of  this  next  wave  of  information-age  busi¬ 
ness  transformation.  In  particular,  enterprises  must 
make  a  fundamental  shift  from  the  “business  as 
usual”  of  the  past  to  a  future  built  on  innovative  ser¬ 
vice-oriented  business  processes  that  are  supported 
by  a  modular,  manageable  IT  infrastructure.  In  fact, 
by  becoming  a  Service- Oriented  Enterprise  (SOE), 
global  organizations  can  reorganize  and  execute  to 
become  faster  and  more  responsive  to  changes  in  the 
marketplace. 

SOE  is  largely  about  how  the  business  organizes 
itself  around  the  use  of  technology.  Above  all,  SOE 
focuses  on  the  business  imperative  and  offers  oppor¬ 
tunities  to  approach  business  issues  in  a  different  way. 

No  More  “Business  as  Usual” 

To  create  SOE  road  maps  that  promise  an  end  to 
“business  as  usual,”  Intel,  the  worldwide  leader  in  sili¬ 
con  innovation,  is  working  together  with  Capgemini, 
recognized  for  its  thought  leadership  in  service  orien¬ 
tation. 

In  fact,  Intel  and  Capgemini  have  found  that 
organizations  that  successfully  embrace  change  have 
learned  a  number  of  key  lessons: 

•  Valuable  Services  Must  Cross  Firewalls:  Don’t 
keep  services  hidden  internally.  Put  them  in  the 
hands  of  others  in  your  enterprise. 

•  Empower  the  Edge:  Provide  services  and  tools  to 


Intel,  the  Intel  logo,  vPro,  Itanium,  Xeon,  and  Centrino  are  trademarks  or  registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the  United  States  and  other  countries.  Other  names  and  brands  may  be  claimed  as  the  property  of  others. 
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At  NATO,  Thought  Leadership,  Supported  by 
Enterprise  Architecture,  Brings  SOE  to  Life 

Capgemini  uses  the  concept  of  the  service-oriented  enterprise  to 
connect  SOA  technology  with  desired  business  change  -  not  on  a 
theoretical  level  but  in  terms  of  specific,  achievable  action.  But  rather 
than  sell  this  as  an  abstract  proposition  to  customers,  the  firm  prefers  to 
tackle  business  issues  head  on. 

“In  order  to  achieve  real  collaboration,  it  is  essential  that  people, 
organizations  and  services  work  together  seamlessly,”  says  Olaf 
Kruidhof,  Senior  Systems  Architect,  NATO  C3  Agency,  one  of  Capgemini’s 
customers. 

When  Capgemini  brought  its  SOE  vision  to  NATO,  that  organization’s 
requirement  was  to  boost  interoperability.  In  order  to  meet  and  manage 
these  requirements  the  organization  adopted  a  services-oriented 
approach  that  was  developed  using  NATO’s  own  methodologies,  along 
with  best  practice  from  Capgemini  and  other  sources  in  industry 
and  academia.  All  types  of  services  are  now  included,  ranging  from 
operational  and  business  information,  to  user/IS  and  technical 
infrastructure. 


allow  those  close  to  customers  and 
markets  to  innovate. 

•  Innovate,  Capture  Value,  Then 
Integrate:  Don’t  wait  for  end-to-end 
service  enablement;  do  business  now 
and  improve  infrastructure  gradually. 

•  Practice  Safe  SOA:  With  service- 
oriented  architecture  (SOA),  establish 
standards  for  security  and  operational 
quality,  while  still  empowering  innova¬ 
tion  at  the  edges. 

•  Dump  HTML:  Use  the  web  as  a  gate¬ 
way  to  allow  customers  to  find  you. 
Then  bring  them  into  a  better  user 
interface  to  transact  business. 

•  Computers  Serve  Humans:  Opti¬ 
mize  in  every  way  possible  to  increase 
human  efficiency. 

Built-in  Capabilities 

Success  in  applying  these  SOE  lessons 
comes  in  part  from  building  solu¬ 
tions  on  the  right  foundation.  Just  as 
SOA  represents  a  new  generation  of 
software,  Intel  brings  a  whole  crop 
of  next-generation  computing  plat¬ 
forms  to  market  that  can  amplify  its 
advantages.  This  includes  new  mobile 
clients  based  on  Intel® 

Centrino®  Duo  mobile 
technology.  Notebooks 
and  tablets  based  on 
this  highly  capable 
wireless  computing 
platform  can  “empow¬ 
er  the  edge,”  where 
employees  interact 
with  customers. 

Similarly,  business 
desktop  PCs  with  new 
Intel®  vPro™  tech¬ 
nology  can  provide 
lower  TCO  through 
built-in  manageability  and  greater 
protection  for  business-critical  data. 
Industry-standard  servers  based  on  the 
next-generation  64-bit  Intel®  Xeon® 
and  Itanium®  2  processors  provide  the 
same  high  performance  and  scalability 
as  client  platforms  from  Intel — and 
they  can  scale  dynamically. 

“New  Intel®  platforms  deploying 
with  enhanced  manageability  and 
hardware-based  virtualization  features 


provide  the  ideal  foundation  for  a 
Service  Oriented  Infrastructure  on 
which  to  deploy  SOA  solutions.”says 
Chris  Thomas,  Chief  Strategist,  Intel 
Corporation. 

Today,  with  industry  analysts  pre¬ 
dicting  service-oriented  spending  of 
more  than  $33  billion  annually  by 
2010,  it’s  clear 
that  global  or¬ 
ganizations  are 
focusing  on  new 
business  strate¬ 
gies.  The  focus 
on  SOE  that  Intel 
and  Capgemini 
share  is  about 
building  those 
new  business 
strategies  wisely, 
with  an  infra¬ 
structure  that 
doesn’t  just  fix 
the  past  but  instead  enables  the  future. 

As  Forrester  puts  it,  “Capgemini 
uses  the  concept  of  the  service-orient¬ 
ed  enterprise  (SOE)  to  stress  the  im¬ 
portance  of  achieving  the  desired  busi¬ 
ness  goals  of  business  change. 

But  rather  than  sell  this  as  a 
proposition  to  customers,  the 
firm  prefers  to  tackle  business 
issues  and  uses  SOE  and  SOA 
frameworks  and  approaches 


in  meeting  those  issues  as  a  matter  of 
course.”  * 

“To  become  faster  and  more  agile 
at  responding  proactively  to  change 
drivers,  a  business  needs  to  have 
choices  in  how  it  supports  the  busi¬ 
ness  change,”  says  Capgemini’s  CTO 
Andy  Mulholland.  “This  could  be  by 
outsourcing  the  processes,  construct¬ 
ing  a  new  capability  internally,  buying 
or  building  an  application  or  any  com¬ 
bination  of  these.” 

Claim  the  Future 

Intel  and  Capgemini  challenge  busi¬ 
ness  leaders  and  IT  organizations  to 
move  beyond  infrastructure  concerns 
toward  becoming  a  service-oriented 
enterprise.  Learn  how  to  take  the  next 
steps  in  this  journey  by  visiting  Next 
Generation  IT  Insights  at  www.next- 
generationinsights.com  for  valuable 
business  and  technical  insights,  real- 
world  case  studies,  webcasts  and  more. 


*Forrester:  “Identifying  Service  Providers’  SOA 
Value”  by  Andrew  Parker,  John  Rymer  and  Caro¬ 
line  Hoekendijk,  February  2006 
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“New  Intel®  platforms  deliver 
enhanced  manageability 
and  hardware-based 
virtualization  features  that 
provide  an  ideal  foundation 
for  a  Service  Oriented 
Infrastructure  on  which  to 
deploy  SOA  solutions.” 
-Chris  S.  Thomas, 

Chief  Strategist,  Intel 
Corporation 


binding  tools  to  virtualize 
and  consolidate  your  data  eentei 
is  easy.  What's  harder  is  finding 
the  tools  to  properly  manage 
this  new  virtualized  world. 
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BY  ROBERT  L.  SCHEIER 

UILDING  the 

next-generation 
data  center  is  one 
thing.  Managing  it 
will  be  another. 

Much  of  the 
technology  to 
virtualize  and  consolidate  servers, 
networks  and  storage  is  here  today 
or  on  the  way.  What  will  take  longer, 
according  to  vendors,  customers  and 
analysts,  is  automating  that  technol¬ 
ogy  to  reconfigure  itself  so  the  most 
critical  applications  or  database  que¬ 
ries  run  the  fastest.  Only  when  that 
automation  is  possible  will  data  cen¬ 
ters  deliver  on  the  promise  of  lower- 
cost  IT  capacity  that  businesses  can 
tap,  like  a  utility,  as  it’s  needed. 

IT  managers  face  “a  big  spider  web 
of  understanding  your  transactions, 
and  where  they’re  running,  and  how 
they’re  running,”  says  an  IT  man¬ 
ager  at  a  national  retail  chain  who 
requested  anonymity.  For  example, 

“I  just  did  a  big  purchase  of  an  IBM 
enterprise  service  bus.  Now,  I’ve  got 
to  see  inside  this  service  bus,  and  see 
where  the  holdup  is.  Is  it  application 
code  at  the  Web  services  level?  Is  it 
MQSeries  [messaging  middleware]? 
If  you  don’t  continually  try  to  auto¬ 
mate,  [this  work]  will  bury  you.” 

Bill  Randall,  director  of  MIS  in¬ 
frastructure  at  restaurant  chain  Red 
Robin  International  Inc.,  says  he 
hasn’t  yet  seen  an  automated  tool 
“that’s  going  to  make  a  better  decision 
than  some  of  my  engineers,”  espe¬ 
cially  when  it  comes  to  correlating 
information  coming  from  different 
parts  of  the  IT  infrastructure.  “I’m 
not  seeing  any  tools  out  there  that 
are  able  to  sift  through  that  amount 
of  data”  and  automatically  determine 
the  root  cause  and  proper  fix  for  a 
problem,  Randall  says. 

In  fact,  most  of  what  research  firm 
Gartner  Inc.  calls  “real-time  infra¬ 
structure”  products  are  “specific  to  a 
particular  problem,  such  as  horizon¬ 
tally  scaling  applications  for  a  partic¬ 
ular  platform,  and  have  limited  or  no 
visibility  of  the  end-to-end  business 
transactions,”  according  to  a  March 
2006  report.  The  key  standards  and 
supporting  products  to  enable  true 
end-to-end  dynamic  management  are 
at  least  several  years  away,  say  cus- 
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[I  haven’t  yet  seen  a  tool]  that’s  going  to  make  a  better  decision  than  some  of  my  engineers. 

BILL  RANDALL,  DIRECTOR  OF  MIS  INFRASTRUCTURE,  RED  ROBIN  INTERNATIONAL  INC. 
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tomers  and  industry  observers. 

The  obstacles  facing  every  cus¬ 
tomer  will  be  unique,  and  so  will  the 
timetables  companies  follow  for  suc¬ 
cessfully  managing  the  next-genera¬ 
tion  data  center.  Here  are  some  of  the 
most  common  challenges  and  how 
some  key  vendors  are  trying  to  meet 
them. 

Beyond  Cost  Cutting 

What’s  been  driving  the  move  to  the 
next-generation  data  center?  So  far,  it’s 
mostly  been  cost  savings.  Companies 
still  recovering  from  the  dot-com  bust 
are  looking  for  ways  to  postpone  or 
avoid  the  purchase  of  new  servers, 
storage  or  software  and  minimize  the 
size  of  their  IT  staffs. 

For  example,  Randall  says  EMC 
Corp.’s  VMware  virtualization  soft¬ 
ware  has  cut  the  time  needed  to 
deploy  a  new  server  at  Red  Robin’s 
Greenwood  Village,  Colo.,  headquar¬ 
ters  from  three  to  four  hours  to  20 
minutes.  Configuresoft  Inc.’s  Enter¬ 


prise  Configuration  Manager  (ECM) 
is  also  saving  him  four  to  six  person- 
days  per  quarter  by  automating  the 
quarterly  reports  he  must  provide 
to  department  heads  about  which 
users  have  permissions  for  accessing 
or  changing  data  in  various  systems. 

At  Polaris  Industries  Inc.,  a  manu¬ 
facturer  of  snowmobiles,  all-terrain 
vehicles  and  motorcycles  in  Medina, 
Minn.,  capital  budgets  have  been  de¬ 
creasing  every  year.  “We  can’t  add 
staff,  but  there’s  more  pressure  to  add 
services,”  says  Dean  Buker,  manager 
of  network  and  systems  operations. 
By  virtualizing  Hewlett-Packard  Co. 
server  blades  with  VMware,  since 
early  2005  Buker  has  slashed  the 
number  of  physical  servers  at  Polaris 
from  120  to  70  and  reduced  the  an¬ 
nual  purchases  of  new  servers  by 
about  70%. 

The  corporate  investment  bank  at 
Wachovia  Corp.  last  year  began  using 
DataSynapse  Inc.’s  FabricServer  for 
its  transaction-oriented  applications. 


Tony  Bishop,  senior  vice  president 
and  director  of  product  management, 
says  FabricServer  has  delivered  50% 
better  performance  at  an  85%  cost 
savings.  It  has  also  allowed  Wacho¬ 
via  to  reallocate  processing  power 
among  multiple  data  centers  in  mul¬ 
tiple  locations  as  the  trading  day 
progresses  around  the  world. 

As  impressive  as  those  numbers  are, 
companies  are  demanding  more  than 
just  savings.  They  want  data  centers 
to  provide  the  flexibility  and  adapt¬ 
ability  that  will  improve  customer 
service  and  speed  the  introduction  of 
products  and  services.  In  a  May  2006 
Computers orld/ CIO  survey,  nearly  as 
many  IT  executives  cited  new  capa¬ 
bilities  as  the  main  reason  to  change 
their  data  centers  (60%)  as  those  who 
cited  cost  cutting  (63%). 

Data  center  managers  are  looking 
toward  virtualization,  consolida¬ 
tion  and  automation.  Virtualization 
means  making  multiple  virtual  de¬ 
vices  appear  as  a  single  logical  device, 
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or  making  a  single  physical  device 
function  like  several  physical  devices. 
Consolidation  means  reducing  the 
types  or  amount  of  hardware  or  soft¬ 
ware  in  the  data  center  to  cut  real  es¬ 
tate,  power,  licensing  or  management 
costs.  Automation  means  reducing 
the  need  for  human  intervention  to 
manage,  troubleshoot  or  optimize  the 
data  center. 

In  general,  consolidation  and  virtu¬ 
alization  are  easiest  to  achieve,  while 
automation  —  specifically,  automated 
management  —  is  toughest. 

Virtualization  Buffet 

There  are  several  flavors  of  server- 
level  virtualization,  and  that  market 
is  dominated  by  VMware.  The  obvi¬ 
ous  cost  benefits  have  resulted  in 
the  explosive  growth  of  VMware, 
Microsoft’s  decision  to  include  a 
hypervisor  in  its  next-generation 
Longhorn  server  and  the  develop¬ 
ment  of  the  open-source  Xen  hyper¬ 
visor  for  Linux. 

IDC  analyst  Stephen  Elliot  and  other 
observers  say  that  as  virtualization 
becomes  ubiquitous,  what  will  distin¬ 
guish  virtualization  software  is  its  abil¬ 
ity  to  provide  security,  management, 
provisioning  and  the  recording  of  CPU 
usage.  These  records  will  allow  IT 
to  charge  business  units  for  the  re¬ 
sources  they  use  —  and  to  measure 
the  value  IT  delivers  to  the  business. 

Among  the  companies  offering 
such  services  are  Marathon  Tech¬ 
nologies  Inc.,  whose  software  links 
multiple  Windows  servers  in  a 
virtualized,  high-availability  envi¬ 
ronment;  Leostream  Corp.,  whose 
software  manages  server  virtualiza¬ 
tion  products  from  VMware  and 
Microsoft;  and  PlateSpin  Ltd.,  whose 
PowerConvert  product  automatically 
distributes  servers  and  data  among 
Windows  virtual  servers. 

In  June,  an  upgrade  to  VMware’s 
server  virtualization  software  added 
new  power  management  capabilities, 
a  distributed  file  system  that  allows 
users  to  pool  heterogeneous  storage 
arrays  into  virtual  volumes  and  a 
distributed  resource  scheduler  that 
automatically  redistributes  virtual 
machines  among  the  physical  servers 
as  application  demands  change. 

PolyServe  Inc.  in  Beaverton,  Ore., 
performs  virtualization  at  the  file- 


HINDERED  BY  MANAGEMENT 

The  lack  of  which  technologies 
currently  limits  your  ability  to 
have  a  “lights  out”  data  center? 

Interface  standards/systems  that 
let  various  management  tools 
work  together  automatically 

Management  and  monitoring  tools 
to  identify/address  security  or 
compliance  issues 

Policy-based,  self-configuring 
systems  to  handle  routine 
adjustments  automatically 

Support  desk  and  system 
management  tools  that  work 
together  automatically 

Remote  access  and  management 
tools  for  IT  staff,  to  allow 
remote/off-site  management 

BASE:  389  IT  executives;  respondents  could 
choose  all  that  apply 

SOURCE:  EXCLUSIVE  COMPUTER  WORLD/CIO  SURVEY, 
CONDUCTED  MAY  2006 

SERVER  SQUEEZE 

My  company  is  currently 
involved  in  consolidating: 

Hardware  servers  (through  clusters, 
blade  servers,  multicore 
hardware) 

Storage  through  virtualization 
or  other  consolidation 

Networks  (such  as  adding 
VoIP  to  an  existing  network) 

Applications  (attempting 
to  reduce  the  number  of 
licenses  or  seats) 

Physical  data  centers 

None  of  the  above 

BASE:  389  IT  executives;  respondents  could 
choose  all  that  apply. 

SOURCE:  EXCLUSIVE  COM  PU  T  E  RWORLO I  CIO  SURVEY. 
CONDUCTED  MAY  2Q06 


server  level  with  separate  file-serving 
and  database  “utilities.”  With  Poly- 
Serve,  says  CEO  Mike  Stankey,  “cus¬ 
tomers  can  literally  drag  and  drop 
the  database  onto  a  bigger  or  smaller 
server”  and  build  policies  dictating 
when  performance  slowdowns  will 
trigger  such  a  move.  PolyServe  com¬ 
plements,  rather  than  replaces,  proc¬ 
essor-level  virtualization  such  as  that 
provided  by  VMware,  he  says.  That’s 
because  VMware  and  similar  virtual¬ 
ization  products  don’t  automatically 


reconfigure  those  applications  so 
backup  and  other  functions  work 
in  the  virtualized  environment. 

Work  in  Progress 

Storage  virtualization  promises  sav¬ 
ings  by  increasing  the  utilization 
of  existing  disk  space  and  easier 
management  of  fewer  disk  pools,  as 
well  as  business  benefits  through 
improved  information  sharing. 
However,  a  lack  of  standards  and  im¬ 
mature  technology  have  limited  its 
deployment.  Many  storage  virtualiza¬ 
tion  products  work  best  or  work  only 
within  arrays  from  a  single  vendor. 

Virtualized  servers  sometimes  don’t 
work  well  with  virtualized  storage  be¬ 
cause  currently,  every  virtual  machine 
in  a  server  must  share  the  same  ex¬ 
ternal  storage  resources  and  a  single 
set  of  addresses  in  a  Fibre  Channel 
storage-area  network.  This  makes  it 
harder  for  administrators  to  create 
separate  zones  for  development,  test 
and  production  virtual  machines; 
prioritize  SAN  resources  for  mission- 
critical  applications;  and  quickly  move 
a  virtual  server  to  another  physical  ma¬ 
chine  in  case  of  a  hardware  failure. 

A  new  standard  called  N-Port 
ID  Virtualization,  or  NPIV,  allows  a 
single  host  bus  adapter  (HBA)  to  use 
multiple  addresses  within  a  storage 
network.  Now  available  only  on  IBM 
zSeries  mainframes,  HBA  vendor 
Emulex  Corp.  is  working  to  expand 
NPIV  to  other  platforms. 

Some  virtualization  is  possible  at 
the  network  level  through  products 
such  as  Cisco  Systems  Inc.’s  Catalyst 
Switching  Series.  These  products  al¬ 
low  the  partitioning  of  a  single  physi¬ 
cal  network  into  many  virtual  net¬ 
works,  which  can  be  configured  for 
the  performance  or  security  needs  of 
specific  applications  or  networks. 

Where’s  the  Holdup? 

One  of  the  big  challenges  is  looking 
deep  within  complex,  multitiered  or 
service-oriented  applications  to  see 
what  hardware  or  software  is  causing 
a  slowdown.  CoreFirst  Transaction 
Workload  Management  software 
from  OpTier  Ltd.  in  New  York  is  one 
of  the  strongest  players  in  this  field, 
according  to  several  customers,  who 
declined  to  be  identified. 

Unlike  other  products,  OpTier’s 
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Data  Center  Technologies:  What’s  Next? 


SERVERS 


Some  tasks,  such  as  restarting 
failed  processes,  can  be  auto¬ 
mated  through  existing  manage¬ 
ment  tools  but  might  require 
scripting.  Management  vendors 
are  still  building  capabilities  to 
automate  configuration  and 
network/storage  connections  in 
virtualized  environments. 

Processor-level  virtualization  is 
becoming  a  commodity;  growth 
is  in  tools  to  provide  security, 
management  and  auditability  for 
virtual  server  environments. 


Virtualization  reduces  costs 
by  up  to  85°/o  by  eliminating 
underutilized  servers  and  trim¬ 
ming  licensing  and  manage¬ 
ment  costs. 


Virtualization  and  consolidation 
will  become  even  more  common 
over  the  next  12  to  18  months 
as  server  vendors  roll  out  more- 
powerful,  multicore  processors. 
Vendors  will  work  to  integrate 
server,  network  and  storage 
management  in  fewer  consoles. 
True  “single-console”  manage¬ 
ment  across  vendors  isn’t  ex¬ 
pected  until  at  least  2008. 


NETWORKS 


Simple  network  manage¬ 
ment  and  monitoring  tools 
are  common,  but  manag¬ 
ers  are  reluctant  to  give 
up  control  for  higher-level 
changes. 


Many  vendors  provide  vir¬ 
tualization  at  the  network 
level  (such  as  virtualized 
file  systems).  Virtualization 
of  the  network  itself  (such 
as  virtual  LANs)  has  been 
maturing  for  several  years. 

Many  users  consolidate 
voice  and  data  networks 
using  VoIP,  but  virtualiza¬ 
tion  is  used  more  to  tune 
virtual  networks  for  spe¬ 
cific  applications  than  to 
reduce  bandwidth. 

Vendors  will  work  toward 
more  automated  and  policy- 
based  management  that 
links  network  performance 
to  business  needs.  Initial 
products  are  available 
now;  increased  adoption 
is  expected  over  the  next 
two  to  three  years.  Vendors 
will  also  work  to  integrate 
server,  network  and  stor¬ 
age  management  in  fewer 
consoles.  True  single¬ 
console  management 
across  vendors  isn’t  ex¬ 
pected  until  at  least  2008. 


STORAGE 


It’s  relatively  easy  to  automate 
the  provisioning  of  volumes  and 
logical  unit  numbers  in  a  single¬ 
vendor  environment,  but  it’s 
much  harder  to  do  so  over  multi¬ 
vendor  arrays.  It’s  also  difficult  to 
accomplish  across  storage  types 
(file  vs.  block). 


As  with  automation,  virtualization 
is  much  easier  in  single-vendor 
environments  than  across  arrays 
from  multiple  vendors  or  across 
network  protocols. 


Rising  storage  capacities  make 
consolidation  easier,  but  man¬ 
agement  tools  are  still  lacking. 


Over  the  next  two  to  three  years, 
vendors  are  expected  to  intro¬ 
duce  software  with  improved 
abilities  to  automatically  migrate 
storage  among  tiers  and  manage 
performance  to  meet  business 
service-level  agreements.  In¬ 
creasing  adoption  of  the  SMI-S 
interoperability  standard  will 
slowly  ease  integration  woes. 
Vendors  will  work  to  integrate 
server,  network  and  storage 
management  in  fewer  consoles. 
True  single-console  management 
across  vendors  isn’t  expected 
until  at  least  2008. 


h 
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CoreFirst  examines  queries  within 
databases  to  find  those  that  use  too 
many  CPU  cycles,  too  much  memory 
or  too  much  of  the  server’s  I/O  sub¬ 
system,  says  the  IT  manager  at  a 
leading  retailer.  It  can  also  prioritize 
workloads  so  that  a  query  from  a  ca¬ 
shier  looking  up  the  price  for  a  prod¬ 
uct,  for  example,  gets  higher  priority 
than  a  query  about  last  month’s  sales. 

A  leading  health  care  provider  in 
the  Midwest  deployed  CoreFirst  to 
troubleshoot  performance  problems 


within  a  complex,  fat-client  customer- 
service  application  that  gathers  data 
from  multiple  other  applications. 

“We  can  take  our  application  and 
almost  break  it  down  by  the  busi¬ 
ness  function”  an  employee  is  using, 
such  as  the  time  required  to  look  up  a 
customer  record,  says  the  company’s 
director  of  technology  support,  who 
declined  to  be  identified. 

Virtualization  may  simplify  some 
functions,  but  it  complicates  others, 
says  Dennis  Moreau,  chief  technol¬ 


ogy  officer  at  Configuresoft.  Config- 
uresoft’s  ECM,  for  example,  can  help 
ensure  that  new  virtual  servers  meet 
corporate  and  regulatory  guidelines 
for  security  and  access  control,  are 
properly  configured,  and  have  the 
proper  versions  of  software  and  the  ap¬ 
propriate  security  patches.  By  the  mid¬ 
dle  of  next  year,  Configuresoft  plans 
to  give  users  the  ability  to  check  the 
status  and  configuration  of  instances 
of  an  operating  system  that  exist  on  a 
server  but  are  not  yet  in  operation. 
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The  more  tiers  developers  build  into 
their  applications,  and  the  more  data 
sources  they  touch,  the  more  flexibil¬ 
ity  managers  will  want  in  changing 
—  on  the  fly  and  automatically  —  the 
performance  of  those  components  so 
they  better  match  business  needs. 

David  Miller,  a  director  in  the  tech¬ 
nology  and  infrastructure  practice  at 
systems  integrator  Avanade  U.K.  Ltd., 
used  PolyServe  to  reduce  the  number 
of  “passive”  (or  hot  spare)  servers  for 
a  large  database  deployment  from  500 
to  125.  PolyServe  also  helped  reduce 
fail-over  time  from  five  minutes  to  30 
seconds.  The  next  step,  he  says,  is  for 
products  such  as  PolyServe  to  perform 
such  fail-over  automatically  as  applica¬ 
tions  require  it,  rather  than  requiring 
an  administrator  to  initiate  the  change. 

Systems  administrators  are  re¬ 


luctant  to  give  up  a  lot  of  control  to 
automated  tools.  Randy  Wood,  a  tech¬ 
nical  support  manager  in  BellSouth’s 
Communications  Systems  Group  in 
Atlanta,  uses  the  Network  Automation 
System  from  Opsware  Inc.,  but  only  to 
view  alerts  from  customer  networks. 
“It’s  unlikely  we  would  let  the  [soft¬ 
ware]  just  execute  [a]  change”  with¬ 
out  first  contacting  the  customer,  he 
says.  A  customer  might  have  violated 
network  routing  policies,  says  Wood, 
but  only  to  troubleshoot  a  problem 
—  something  the  software  would  have 
no  way  of  knowing. 

The  Value-Adds 

Some  companies  turn  to  IT  automa¬ 
tion  software  not  to  manage  their  sys¬ 
tems,  but  to  monitor  their  compliance 
with  regulations  governing  things 


such  as  access  to  critical  data.  That’s 
the  case  at  restaurant  chain  Red  Rob¬ 
in,  which  uses  Configuresoft’s  ECM 
to  ensure  the  proper  configuration  of 
45  Windows  servers  at  its  headquar¬ 
ters.  The  company  also  uses  ECM  to 
instantly  change  passwords  in  the 
service  accounts  in  its  Windows  Ac¬ 
tive  Directory  domains,  a  process  that 
used  to  take  48  hours,  says  Randall. 

But  it  will  be  several  years  at  least  be¬ 
fore  a  single  “dashboard”  exists,  observ¬ 
ers  say.  They  advise  IT  managers  to 
standardize  the  products  they  buy  and 
the  way  they  configure  them  to  give 
automated  tools  a  chance  to  work.  ♦ 


Scheier  is  a  freelance  writer  in 
Boylston,  Mass.,  and  a  frequent  con¬ 
tributor  to  Computerworld.  Contact 
him  at  rscheier@charter.net. 
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Vendors  Chase 
Data  Center  Space 

The  next-generation  data  center  will  require  special¬ 
ized  technologies,  as  well  as  high-level  management 
software  for  a  unified  view. 

One  of  the  stronger  companies  is  Opsware  Inc., 
says  IDC  analyst  Stephen  Elliot,  which  has  “done  a 
good  job  in  [the]  niche  market”  of  server  and  net¬ 
work  configuration  and  provisioning.  Another  firm 
cited  by  Elliot  and  Gartner  is  OpTier  Ltd.,  whose 
CoreFirst  “autodiscovers,  tracks  and  monitors  unique 
transactions”  and  enables  policies  that  give  specific 
transactions  more  access  to  CPU,  memory  or  other 
sources,  according  to  a  March  2006  Gartner  report. 

Another  firm  cited  by  both  research  groups  is 
Cassatt  Corp.  Gartner  says  its  Collage  software 
creates  virtualized  hardware  and  software  resources 
running  on  Linux,  Solaris  and  Windows  and  then  lets 
administrators  scale  capacity  as  needed.  Cassatt’s 
focus  is  on  scaling  a  specific  layer  of  an  application 
environment,  such  as  the  J2EE  application  server 
tier,  according  to  Gartner,  rather  than  on  optimizing  a 
specific  function  such  as  inventory  lookups. 

Splunk  Inc.  uses  search  technology  to  help  IT 
managers  find  the  causes  of  problems  from  unstruc¬ 
tured  data  such  as  server  and  event  logs,  and  inte¬ 
grates  with  CA’s  Unicenter  NSM  R11. 

IBM  is  driving  several  key  standards  for  captur¬ 
ing  and  sharing  data  about  the  IT  environment,  says 
Ric  Telford,  vice  president  of  autonomic  computing 
at  IBM’s  Tivoli  unit.  They  include  the  Solution  De¬ 


ployment  Descriptor  Standard,  which  describes  the 
specifications  for  deploying  an  operating  system, 
server  or  application;  and  Configuration  Manage¬ 
ment  Databases,  which  describe  the  state  of  all  the 
components  within  the  IT  infrastructure. 

Hewlett-Packard  Co.  has  a  proven  set  of  man¬ 
agement  products  and  a  large  installed  base  with 
its  OpenView  management  suite,  says  Elliot.  It  has 
also  developed  products  such  as  Business  Process 
Insight,  which  focuses  on  automation. 

CA  Inc.  “has  really  put  a  lot  of  work  into  integra¬ 
tion”  within  its  Unicenter  suite  of  management  appli¬ 
cations,  Elliot  says,  “but  with  a  recent  spate  of  acqui¬ 
sitions”  has  yet  more  integration  work  to  do. 

BMC  Software  Inc.  provides  a  number  of  infra¬ 
structure  management  tools,  such  as  its  BMC  Virtu- 
alizer  line,  which  provides  automated,  policy-based 
provisioning  of  additional  capacity  for  applications 
running  on  virtual  machines  or  physical  servers. 

EMC  Corp.,  owner  of  VMware,  has  bought  net¬ 
work  manager  vendor  Smarts  Inc.  With  its  presence 
in  large  firms,  EMC  “is  one  acquisition  away  from 
changing  the  game  for  a  lot  of  players,”  says  Elliot. 

Microsoft  Corp.  is  a  “sleeping  giant”  -  aggres¬ 
sive  with  rollouts  “but  late  to  the  game  in  virtualiza¬ 
tion  and  still  Windows-centric,”  he  says.  Microsoft 
is  developing  its  own  virtualization  management 
software,  code-named  Carmine,  says  Eric  Berg,  a 
director  in  the  Windows  and  enterprise  management 
division.  Next  year,  the  company  plans  to  release 
Systems  Center  Service  Desk,  which  will  link  people, 
processes  and  technologies  to  solve  problems,  man¬ 
age  assets  and  provide  change  management. 

-  ROBERT  L.  SCHEIER 

—  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  —  J 
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How  do  you  maximize 
the  value  of  IT? 


IT  is  still  one  of  the  most  misunderstood  functions  in  business. 

The  CIO  Executive  Council,  a  professional  community  developed  by  CIOs,  has  focused  its  members' 
collective  effort  on  this  challenge.  Their  initiative  has  resulted  in  groundbreaking  tools-the  IT  Value 
Matrix  and  Knowledge  Center™-to  help  leverage  the  value  of  IT  throughout  the  organization. 

The  IT  Value  Matrix  illustrates  the  principles  and  practices  essential  to  creating,  identifying  and 
communicating  IT's  value  to  the  enterprise.  Its  online  Knowledge  Center  provides  best  practices 
contributed  by  Council  members,  supplemented  by  case  studies  and  how-  to  articles  from 
CIO  magazine  that  are  grouped  in  categories  that  correspond  to  all  the  components  of  the  Matrix. 
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Visit  www.cioexecutivecouncil.com/it_value  to  get  your  own  copy  of  the  Matrix  and 
to  watch  the  IT  Value  webcast,  presented  by  Agriliance  CIO  and  Council  member  Steven  John. 


CIO  Executive  Council 

The  Professional  Organization  for  CIOs 


The  CIO  Executive  Council  was  created  by  readers  of  CIO  magazine  and  leaders  within 
the  community  of  CIOs  to  leverage  the  individual  and  collective  strengths  of  its  members  by 
serving  as  unbiased  and  trusted  advisors  to  each  other,  and  by  advancing  the  CIO  role  and 
profession.  In  just  two  years,  more  than  300  CIOs  worldwide  from  various  sectors  and  indus¬ 
tries  have  identified  with  the  Council's  vision  and  committed  to  assist  each  other,  cultivate 
their  own  careers  and  those  of  their  team,  and  advance  the  role  of  the  CIO. 

To  inquire  about  membership,  visit  www.cioexecutivecouncil.com. 
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center  is  clearly  a  system  in 
flux.  In  a  joint  Corrputerworld/CIO 
survey,  close  to  half  of  the  respon¬ 
dents  reported  that  their  compa¬ 
nies  will  expand  their  data  facilities 
within  the  next  three  years,  and 
almost  one  quarter  said  they  are 
planning  to  reduce  or  consolidate 
their  facilities.  Most  are  seeking 
to  cut  costs  (63°/o),  but  an  almost 
equal  number  expect  more:  They 
want  their  data  center  overhauls 
to  bring  new  capabilities  without 
increasing  costs  (60°/o). 

IT  managers  also  want  things 
simpler.  When  asked  about  con- 


Expert  on  Staff 

Which  of  the  following  state¬ 
ments  describe  your  current  data 
center  environment?* 


IT  staff  is  composed  of 

specific  experts  for  most  areas.  52% 


IT  staff  is  composed  mainly 
of  generalists  who  can  handle 
multiple  operations. 

46% 

Data  center  relies  heavily  on 
homogeneous  environments 
to  reduce  complexity. 

41% 

Data  center  is  largely  automated 
(lights-out):  IT  staff  handles 
exceptions  vs.  routine 
maintenance. 

34% 

Data  center  relies  heavily  on  hetero¬ 
geneous  environments  to  deliver 
best-of-breed  functionality.  24% 

Data  center  is  broadly  distributed 
and/or  managed  significantly  by 
remote  staff  or  providers. 

18% 

Data  center  relies  extensively  on 
virtualization  to  reduce  use  of 
proprietary  hardware. 

15% 

Data  center  is  outsourced  to 
one  or  more  third-party  hosts. 

15% 

dents  said  they  expect  server 
virtualization  and  standardized 
hardware  to  make  their  data  cen¬ 
ters  simpler  to  manage  (66°/o) 
and  more  energy-efficient  (48%). 

Yet  there  are  worries,  too:  44% 
said  they  are  concerned  that  con¬ 
solidation  won’t  reduce  costs  but 
will  shift  expenses  to  other  areas. 
And  the  same  number  of  respon¬ 
dents  worry  that  the  skill  set  need¬ 
ed  to  manage  consolidated  data 
centers  will  actually  expand.  ♦ 


Mainframe,  Be  Gone 

Mainframes  once  dominated  data 
centers,  but  their  importance  has 
decreased  in  recent  years.  Which 
of  the  following  most  closely  de¬ 
scribes  the  outlook  for  your  main¬ 
frame  environment  over  the  next 
three  years? 


■  We  will  completely  eliminate 
our  mainframe  environment. 


■  The  number  of  MIPS 
we  have  will  remain  steady. 

The  number  of  MIPS  we 
have  installed  will  decline  from 
current  levels. 

■  We  will  grow  our  MIPS 
primarily  due  to  new  applications. 


IT  Takes  the  Lead 

Which  groups  are  involved  in 
the  space  planning  for  your 
company’s  data  center?* 


72% 

A  facilities  committee/ 

physical  plant  committee  36% 

Executive  board  17% 

All  of  the  above  28% 

Other  3% 

I 


Simplicity,  Please 

Many  enterprises  are  told 
to  consolidate  their  data  cen¬ 
ters  to  reduce  their  scale  and 
operational  costs  using  tech¬ 
niques  such  as  virtualization 
and  standardized  hardware. 

If  you  were  to  consolidate  your 
data  center,  what  outcomes 
would  you  expect?* 

The  data  center  will 

get  simpler  to  manage.  66% 

The  data  center  will  become 

more  energy-efficient.  48% 

The  data  center  will  need 

less  hardware.  47% 

The  data  center  will  require 

fewer  staff  resources.  47% 


The  data  center  will  get  smaller.  24% 


Shifting  Burdens 

If  you  were  to  consolidate  your 
data  center,  which  issues  would 
be  of  greatest  concern?* 

The  skill  set  needed  to  manage 
the  data  center  will  increase.  44% 

The  overall  data  center  cost  won’t 
change  significantly  but  will  shift 
from  one  area  to  another.  44% 

The  consequences  of  system 
failure  increase  unacceptably.  42% 

Data  center  productivity  drops.  20% 


Respondents  could  choose  all  that  apply. 

SOURCE:  EXCLUSIVE  COMPUTERWORLD/CIO  SUR¬ 
VEY  OF  389  IT  EXECUTIVES.  CONDUCTED  MAY  2006 
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Microsoft  Legal  Issues  • 


Oracle  today  announced  its  secon-’ 
in  just  9  months,  this  time  '  ' 
agreed  on  a  deal 
share.  Re*-* 
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The  No.  1  Enterprise  IT  Web  site  just  got 

Faster 

Richer 

Deeper 

...  and  a  little  more  colorful. 
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The  spinoff  that  acted  like  a 

Avaya,  a  global  leader  in  communication  software,  systems  and  services,  spun 
off  from  Lucent  with  a  legacy  IT  infrastructure  that,  while  efficient,  wasn’t  nimble 
enough  to  be  a  competitive  advantage.  HP  partnered  with  Avaya  to  implement 
IT  Service  Management  and  HP  OpenView,  effectively  re-deploying  existing 
technology  assets.  Today,  IT  spending  is  down  30%.  Millions  have  been  saved 
by  finding  unused  capacity.  And  Avaya  answers  whenever  opportunity  calls, 
hp.  com/adapt 

HP  IT  Service  Management  |  HP  OpenView  software 
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FROM  INCEPTION  TO  IMPLEMENTATION  — I. T.  THAT  MATTERS 


Microsoft's  next 
big  operating 
system  upgrade 
has  a  wealth  of 
new  business 
features— but 
how  badly  do 
you  really  need 
them? 


On  the  Lookout  for  Vista 


BY  DYLAN  TWENEY 

OPERATING  SYSTEMS  |  Microsoft’s  first  major  operating  system  upgrade  in  five 
years,  Windows  Vista,  is  expected  to  hit  the  retail  shelves  in  January. 

Originally  scheduled  for  2003,  Vista’s  release  date  was  pushed  back  many  times  due 
to  development  delays.  And  the  delays  have  created  openings  for  the  growth  of  competi¬ 
tors,  such  as  Apple  on  the  desktop  and  Linux  on  the  server.  But  Microsoft’s  market  share 
remains  overwhelming.  Like  it  or  not,  Vista  will  eventually  become  Microsoft’s  default 
OS.  So  the  question  is  not  whether  you’ll  be  making  the  switch  to  Vista,  but  when. 

In  fact,  if  your  company  has  a  volume  licensing  agreement  with  Microsoft,  you’ll  have 
a  chance  to  upgrade  to  the  client  version  of  Vista  as  early  as  November,  when  the  operat¬ 
ing  system  will  be  shipped  to  computer  manufacturers  and  other  large  customers.  (The 
server  version  of  Vista,  still  nicknamed  Longhorn,  isn’t  scheduled  to  ship  until  2007.) 

Still,  there  are  good  reasons  why  IT  managers  are  saying  “wait  and  see.”  Upgrades 
are  time-consuming  and  expensive,  requiring  lots  of  testing,  training  and  support.  Then 
there’s  the  hardware.  Vista’s  almost  certainly  not  going  to  run  well  on  older  machines. 

“IT  managers  probably  won’t  make  the  investment  [in  upgrading]  until  after  Vista  has 
been  on  the  market  for  awhile,”  says  Jim  Michael,  secretary  of  the  board  of  directors  of  Share, 
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an  IBM  users’  group  with  more  than  2,000 
member  companies  representing  a  major¬ 
ity  of  the  Fortune  500.  “You  may  not  see 
widespread  enterprise  deployment  until 
after  the  first  service  pack  comes  out.”  And 
that  could  be  as  much  as  a  year  after  Vista 
first  ships. 

But  you’d  better  begin  planning  now. 
Once  the  OS  is  widely  available,  end  users 
(like  your  CEO)  will  start  asking  about  it. 

Windows  XP  is 
lookinga  little 
long  in  the  tooth, 
and  Vista’s  new 
Windows  Aero 
interface  is  a  lot 
slicker(andalot 
more  Mac-like). 

It  will  begin  showing  up  on  new  desktops 
and  laptops.  And,  if  there’s  a  major  secu¬ 
rity  attack  aimed  at  legacy  Windows  XP 
systems,  you  could  find  yourself  under 
very  serious  pressure  to  upgrade  fast. 

Security  and  Manageability 

Vista  offers  some  enticing  features  for 
CIOs.  Perhaps  primary  among  them  are 
its  numerous  security  enhancements. 
“This  is  an  operating  system  that  was 
built  and  architected  in  the  age  of  the 
Internet,”  says  Michael  Gartenberg,  VP 
and  research  director  for  JupiterResearch. 
In  contrast  to  Windows  XP,  Vista  will  be 
much  more  resistant  to  Internet-based 
attacks,  he  says. 

Vista  also  offers  authentication  via 
smart  cards  in  addition  to  user  name 
and  password  checking,  provides  more 
nuanced  user  account  restrictions  and 
offers  strong,  hardware-based  encryp¬ 
tion,  which  can  protect  documents  when 


an  employee’s  laptop  is  stolen.  It  will  also 
make  it  easier  for  developers  to  customize 
their  own  authentication  strategies  with 
biometrics  and  tokens. 

Almost  equally  important  are  Vista’s 
management  features.  “Vista  will  help 
ease  the  pain  of  deploying,  supporting  and 
managing  desktops,”  says  Michael  Burk, 
a  product  manager  in  the  Windows  client 
division  of  Microsoft.  Microsoft  claims 
that  administrators  will  be  able  to  control 
desktop  settings  remotely  via  command 
line,  eliminating  the  need  for  your  IT  staff 
to  visit  every  desktop  when,  for  instance, 
it’s  time  to  upgrade  client  virus-scanning 
software.  To  streamline  installation,  Vista 
will  ship  with  a  suite  of  disk  imaging  and 
installation  tools  so  IT  departments  can 
configure  standard  installations  easily 
and  then  copy  them  onto  new  computers 
with  a  minimum  of  fuss. 

A  Shiny  New  Interface 

Vista’s  new  interface  and  multimedia 
features  may  be  the  system’s  most  visible 
enhancements.  Windows  XP  is  looking 
a  little  long  in  the  tooth,  and  Vista’s  new 
Windows  Aero  interface  is  a  lot  slicker 
(and  a  lot  more  Mac-like),  with  transpar¬ 
ent  windows  and  a  variety  of  3-D  effects. 

All  those  effects  require  fairly  serious 
graphics  processing  power.  However, 
there’s  an  option  for  systems  with  slower 
video  subsystems.  If  a  PC’s  graphics  pro¬ 
cessor  can’t  handle  Aero,  the  user  can 
turn  it  off,  defaulting  to  a  plainer  but  less 
resource-intensive  interface. 

Still,  it’s  unlikely  that  the  new  interface 
is  going  to  be  a  major  factor  in  a  CIO’s 
decision  to  upgrade.  “OK,  so  it’s  a  cooler¬ 
looking  Windows  interface.  I’m  not  sure 
where  the  big  payback  for  the  enterprise 
is  for  a  cooler-looking  Windows  inter¬ 
face,”  says  Share’s  Michael. 

Two  for  the  Business 

Windows  Vista  will  ship  with  two  busi¬ 
ness-oriented  versions:  Windows  Vista 
Business  and  Windows  Vista  Enterprise. 
“Windows  Vista  Business  edition  is  opti¬ 
mized  for  small  to  medium-sized  busi- 


Alt-Upgrades 

Upgrade,  shmupgrade.  You  can  get 
many  of  Windows  Vista’s  features  for 
free  (or  low  cost)  today,  with  these 
downloadable  utilities. 

Microsoft  Windows  Live  Safety  Cent* 

( http://safety.live.com/site/en-US/ 
default.htm ) 

Provides  online  virus  and  spyware 
scanning;  can  enhance  PC  perfor¬ 
mance  by  removing  junk  files  and 
optimizing  your  hard  drive.  A  related 
service,  Windows  Defender,  continu¬ 
ously  monitors  your  computer  for  sp; 
ware.  Both  are  betas.  Cost:  Free. 

Kensington  PCKey 

(http://us.kensington.com/ 
html/6331.html ) 
Software-and-hardware  product 
protects  hard  drive  with  128-bit  AES 
encryption.  Unlocked  only  by  USB  ke 
and  password.  Cost:  $70. 

Microsoft  Color  Control  Panel  Apple 

(www.microsoft.com/downloads) 

Art  geeks  will  appreciate  Vista’s  color 
management  tools.  Marketing  deparl 
ment  can’t  wait  that  long?  Give  them 
this  color-management  utility  for  Wir 
dows  XP.  Cost:  Free. 

Axantum  Software  AxCrypt 

( http://axcrypt.axantum.com ) 
Freeware  utility  integrates  into 
Explorer  and  lets  you  encrypt  any  file 
folder  with  128-bit  AES  encryption  jus 
by  right-clicking.  Cost:  Free. 

Microsoft  Alt-Tab  Replacement 
Stardock  WindowBlinds 

( www.windowblinds.net ) 

Makes  Windows  XP  "skinnable,"  so 
you  can  redecorate  your  interface  wit , 
any  of  several  thousand  downloadabl 
themes— including  some  very  Vista¬ 
like  looks.  Cost:  $20:  site  offers  a  60- 
day  free  trial. 

-d: 
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YOU  NEED  A  3M  PRIVACY  FILTER  BECAUSE 
READING  A  LAPTOP  SCREEN  IS  IRRESISTIBLE 


SEE 


IJjet  your  work  done.  The  wandering  eyes  beside  you  see  only  a  dark  screen.  Reassuring  3M'“  Privacy  Filters.  Made  of  slim,  protective,  rigid-yet-flexible  polymer, 
to  attach  and  remove.  Available  for  laptops  in  many  sizes.  Uncanny  3M  microlouver  technology  blocks  out  side  views  while  you  see  your  screen  clearly  as  ever. 
You  have  to  not  see  it  to  believe  it.  Available  only  at  online  retailers.  1-888-PRIVACY  3MPrivacyFilter.com 


3M 

Privacy  Filters 


id  the  Vikuiti  "Eye'  symbol  are  trademarks  of  3M. 


Now  you  see  it.  Now  they  don’t. 
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nesses,  but  it’s  designed  to  meet  the  needs 
of  organizations  of  all  sizes,”  says  Micro¬ 
soft’s  Burk.  Vista  Business  will  include  IT 
management  tools,  end  user  search  tools 
for  organizing  and  sorting  through  large 
quantities  of  business  documents,  and 
Tablet  PC  support. 

Vista  Enterprise  is  aimed  at  larger  orga¬ 
nizations  and  adds  enhanced  application 
compatibility  tools,  disk  image  manage¬ 


ment  tools  (for  creating  and  distributing 
standard  installations),  and  the  ability 
to  run  Unix  applications  on  Vista  PCs. 
Vista  Enterprise  will  be  available  only  to 
corporate  customers  that  are  enrolled  in 
Microsoft’s  Software  Assurance  program 
or  a  Microsoft  Enterprise  Agreement. 

Proceed  with  Caution 

If  there  aren’t  compelling  business  rea¬ 
sons  to  make  the  switch  to  Vista  in  2006, 
consider  putting  it  off.  Alternatively,  you 
can  let  Vista  creep  into  your  enterprise 
gradually  as  you  buy  new  systems  that 
have  the  OS  preinstalled,  recommends 
Rob  Enderle,  principal  analyst  for  the 
Enderle  Group. 

One  reason  for  taking  it  slowly  is  that  Vis¬ 
ta’s  hardware  requirements  are  steeper  than 
those  for  Windows  XP,  and  that  means  a  lot 
of  your  old  computers  won’t  have  enough 
horsepower  to  handle  it.  Although  Micro¬ 
soft  has  published  its  requirements  list  for 
Vista,  Enderle  has  compiled  his  own  list  (see 
“Vista  Systems  Requirements,”  at  right). 
But,  he  acknowledges,  “the  ideal  hardware 
will  be  designed  for  Windows  Vista— and 
that  won’t  show  up  until  the  fourth  quarter 
of  this  year.” 

Even  if  you’re  not  planning  on  installing 
Vista  for  a  year  or  more,  you  still  should 


pay  attention  to  its  hardware  require¬ 
ments.  “Anyone  who’s  buying  hardware 
this  year  needs  to  consider  getting  hard¬ 
ware  that’s  sufficient  for  Windows  Vista,” 
says  Ann  Westerheim,  president  of  Ekaru, 
a  technology  service  provider  for  small  and 
midsize  businesses.  That’s  because  the  typ¬ 
ical  corporate  PC  has  a  three-year  lifespan, 
and  over  the  next  three  years,  you’ll  almost 
certainly  need  to  run  Vista. 


And  don’t  underestimate  the  amount 
of  work  an  operating  system  overhaul  can 
require  in  a  large  enterprise.  “Those  of  us 
who  have  done  it  will  tell  you  it’s  never 
painless,”  says  Jeff  Reed,  CTO  of  Logicalis, 
an  enterprise  IT  service  provider. 

Time  to  Get  Ready 

Now  is  the  time  to  start  learning  about  Vista 
by  studying  the  product  details  that  Micro¬ 
soft  has  published  on  its  main  site  and  on 
the  Microsoft  Developer  Network  site  (see 
msdn.microsofi.com/windowsvista).  If  you  can 
get  into  Microsoft’s  beta  program,  you  will 
gain  firsthand  experience  with  Vista  and, 
even  more  importantly,  can  begin  testing 
its  compatibility  with  your  company’s  key 
applications.  Once  the  OS  ships,  you  want 
to  be  prepared  with  an  upgrade  plan— and 
you  will  be  upgrading,  sooner  or  later. 

“It’s  a  question  of  whether  you  want  to 
deal  with  a  bunch  of  patches  and  fixes  for 
XP  when  you  can  get  everything  that’s 


Essentially  Technical 


Technology  Editor  Christopher  Lindquist  scours 

the  best  of  what's  on  the  Web  when  it  comes 
to  emerging  technology.  Read  his  blog,  TECH 
LINKLETTER,  at  www.cio.com. 

cio.com 


Vista  System 
Requirements 

Windows  Vista  will  almost  certainly 
require  that  you  upgrade  your  older 
systems  or  replace  them  with  newer 
models.  Here  are  the  minimum  sys¬ 
tem  requirements  for  reasonable 
performance  over  the  expected  three- 
year  lifecycle  of  a  new  Vista  desktop, 
according  to  Rob  Enderle,  principal 
analyst  for  the  Enderle  Group: 

CPU:  2GHz  processor  or  faster 

RAM:  1GB  or  more 

Hard  drive:  80GB  (10GB  required  for 
installation);  Microsoft  recommends 
Serial  ATA  drives 

Optical  drive:  DVD  required  for 
installation 

Current  generation  discrete  graph¬ 
ics  systems  with  128MB  of  memory 
or  then  current  generation  inte¬ 
grated  graphics  and  increase  system 
memory  to  2GB  of  fast  dual-chan¬ 
nel  memory.  Both  need  to  support 
DirectX9  (DirectXlO  is  preferred)  and 
the  Windows  Display  Drive  Model  for 
Aero.  -D.T. 

already  incorporated  into  Vista,”  says 
Gartenberg.  Microsoft  says  it  will  con¬ 
tinue  to  maintain  Windows  XP  and  is 
planning  to  issue  Service  Pack  3  for  XP 
in  the  second  half  of  2007,  but  the  trend 
is  clear:  Vista  is  coming  and  will  eventu¬ 
ally  replace  XP. 

The  pressure  will  only  increase  in  Janu¬ 
ary,  when  (or  if)  Vista  hits  retail  shelves. 
“Right  now,  Windows  XP,  with  all  its 
foibles,  is  working  OK.  IT  managers  are 
not  chomping  at  the  bit  to  rip  the  thing 
out  by  the  roots,”  says  Enderle.  “But  that 
could  change  dramatically  once  this  thing 
ships.”  QQ 


Dylan  Tweney  is  a  California-based  science  and 
technology  writer.  Respond  to  letters@cio.com. 


Don’t  underestimate  the  amount 
of  work  an  operating  system  over¬ 
haul  can  require  “It's  never  pain¬ 
less,”  says  Logicalis  CTO  Jeff  Reed. 
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!  As  a  true  entrepreneur,  you  do  things  a  little  differently.  And  so  increase  your  chances 
!  for  success.  To  help  you  realize  your  full  potential  and  use  technology  to  break  down  barriers, 
Equant,  France  Telecom  and  Orange  have  joined  forces  under  Orange  Business  Services. 
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Steps  to  Prioritization 

Too  many  IT  projects  are  based  on  bogus  cost  savings  projections  rather  than  business 
strategy.  Here’s  how  to  link  project  prioritization  directly  to  value. 


Most  IT  project  evaluations  are  like  the  tail  wag¬ 
ging  the  dog.  They  begin  with  IT  strategy, 
rather  than  the  goals  of  the  business.  In  fact, 
IT  strategy  should  be  the  third  link  in  a  chain 
that  begins  with  business  strategy,  which  in  turn  governs  the 
product  or  service  strategy,  which  then  drives  IT  strategy.  Let’s 
look  at  how  this  could  work  in  the  context  of  a  fictional  midsize 
CRM  software  company: 

Business  strategy:  Increase  the  customer  base  by  20  percent 
in  the  next  year  by  providing  increased  functionality  such  as 
business  operations  analytics  and  executive  dashboards. 

Product  strategy:  Develop  an  alliance  with  a  business  intel¬ 
ligence  (BI)  software  company  to  add  analytical  capabilities  to 
the  CRM  software. 

IT  strategy:  Create  a  new  software  platform  that  allows  for 
easy  integration  with  the  BI  software  company  and  others. 

IT  projects:  Develop  a  Web  services-based  platform  that 
offers  universal  data  exchange  and  messaging  between  the 
CRM  software  and  the  BI  software. 

While  this  hierarchy  reveals  whether  IT  projects  are  aligned 
with  the  IT  strategy  (and  therefore,  the  business  strategy),  it 
does  not  determine  the  specific  value  of  those  projects  to  the 
business.  To  do  that,  you  need  to  look  at  four  (and  only  four) 
distinct  drivers: 

Expense  reduction:  In  this  CRM  integration  example,  the  new 
platform  reduces  the  cost  of  developing  links  to  other  vendors’ 
software  because  it  is  based  on  Web  services  standards. 

Revenue  increase:  Overall  revenue  should  increase  as  a  larger 
customer  base  considers  the  CRM  software. 

Strategic:  The  software  platform  project  has  a  direct  impact 
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Is  every  square  inch  of  your  data  center  occupied  by  space-hogging  servers  of  another  era? 
It’s  time  to  pack  more  power  into  your  data  center  with  systems  based  on  the  Dual-Core 
AMD  Opteron™  processor.  They’re  designed  to  generate  less  heat  in  blade  server  environ¬ 
ments,  so  you  can  achieve  higher  server  density  per  rack.  And  thanks  to  its  Direct  Connect 
Architecture  with  HyperTransport™  technology,  the  AMD  Opteron  processor  provides  more 
performance-per-watt  and  CPU  scalability.  In  short,  huge  performance  in  a  smaller  space. 


Competitor 


AMD  Opteron1  M  processors  can  increase  server 
rack  density  by  25°7o  over  the  competition. 
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Smarter  Choice 
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on  the  CRM  product  and  the  company’s  competitive  position. 

Legal/regulatory/security:  Security  is  important  in  the  new 
CRM  software  platform  because  sensitive  data  (Social  Security 
numbers,  for  example)  should  probably  not  be  stored  outside 
of  the  CRM  system. 

Each  project  needs  to  be  evaluated  under  all  four  of  these 
drivers  to  determine  their  priority  and  value  to  the  business. 
These  drivers  should  not  be  considered  in  isolation  from  the 
others,  however.  They  need  to  be  linked  together  in  a  mean¬ 
ingful,  repeatable  process  for  process  prioritization. 

The  Prioritization  Mechanism 

The  first  step  in  creating  a  prioritization  model  is  to  take  a 
top-down  approach  and  break  down  each  driver  into  various 
parameters.  This  should  be  done  by  gather¬ 
ing  insight  from  business  leaders  across  all 
departments  to  understand  business  focus 
areas  and  performance  measurements.  At  the 
CRM  company,  executives  decided  to  break 
down  the  “expense  reduction”  driver  into  four 
parameters:  customer  service  expense,  cus¬ 
tomer  acquisition  and  retention,  back  office 
efficiency  gains  and  other  expense. 

The  second  step  is  to  score  each  project  across 
all  parameters,  a  bottom-up  approach,  to  determine  the  overall 
project  score.  Projects  are  scored  by  presenting  executives  with 
a  set  of  statements  and  asking  for  their  degree  of  agreement  on 
a  scale  from  1  to  10  (also  known  as  a  Likert  scale),  with  specific 
criteria  assigned  to  the  scoring  range.  For  example,  in  the  CRM 
integration  project,  when  executives  were  asked,  “Do  you  agree 
that  this  project  will  result  in  savings  for  the  company?”  a  rat¬ 
ing  of  1  meant  no  savings,  while  a  rating  of  10  was  associated 
with  $20  million.  This  bottom-up  scoring  will  result  in  final 
scores  that  will  automatically  prioritize  the  projects. 

The  third  step  is  to  adjust  the  two  prioritization  levers  by 
assigning  weights  to  the  overall  drivers  (prioritization  lever  1) 
and  their  specific  parameters  (prioritization  lever  2)  according 
to  the  current  business  priorities.  As  those  priorities  change, 

the  weights  can  be  adjusted 
correspondingly,  so  that  the 
score  for  each  IT  project  is 
always  in  line  with  the  busi¬ 
ness  strategy.  These  levers 
should  be  set  based  on  busi¬ 
ness  priorities  for  the  entire 
project  portfolio  and  not  alter  among  projects. 

For  the  CRM  company,  the  weights  for  the  strategic  drivers 
and  parameters  might  look  like  this: 

Prioritization  lever  1  Coverall  strategic  driver 
weights): 

Expense  reduction  (20  percent),  revenue  increase  (20  percent), 
strategic  (40  percent),  legal/regulatory/security  (20  percent). 


Revenue  was  stagnating  because  the  CRM  product  had  little 
differentiation  from  competitors.  Therefore,  big  strategic 
moves,  such  as  alliances,  had  a  higher  priority  than  incre¬ 
mental  revenue  growth.  Alternately,  if  the  company  had  been 
in  financial  crisis,  expense  reduction  would  get  a  much  higher 
weight  than  strategic. 

Prioritization  lever  2  (strategic  driver  parameter 
weights): 

Expense  reduction:  customer  service  expense  (20  percent), 
customer  acquisition  and  retention  (50  percent),  back-office 
efficiency  gains  (20  percent),  other  expense  reduction  (10  per¬ 
cent).  Because  the  CRM  company  is  attempting  to  reach  a  larger 
market,  reducing  customer  acquisition  and  retention  costs  are 
important.  The  integration  project  with  the  BI  company  will 


allow  the  two  companies  to  pool  sales  and  marketing  efforts. 

Revenue  increase:  One-year  revenue  increase  (40  percent), 
one-year  retained  revenue  (20  percent),  three-year  incremen¬ 
tal  revenue  (25  percent),  gross  margin  improvement  (15  per¬ 
cent).  With  a  strategy  that  calls  for  increasing  the  customer 
base  by  20  percent  in  one  year,  the  CRM  company  weights 
short-term  revenue  improvements  higher  than  long-term. 
The  integration  project  will  give  the  company  immediate 
access  to  its  alliance  partners’  customers. 

Strategic:  First  mover/innovation/market  defining 
(10  percent),  fast  follower  (40  percent),  brand  enhancement 
(20  percent),  builds  awareness/upsell  (30  percent).  The  CRM 
company  is  well-established  but  needs  crossover  into  other 
established  markets— thus,  the  high  weighting  to  “fast  fol¬ 
lower”  and  “builds  awareness/upsell.”  Again,  the  integration 
project  with  another  software  company  fits  those  priorities. 

Legal/reguiatory/security:  Legal,  regulatory  requirements 
(20  percent),  labor  issues  (10  percent),  security  and  fraud 
prevention  (40  percent),  compliance  with  corporate  policies 
(30  percent).  Customer  data  security  is  critical  to  the  CRM 
company. 

To  prevent  subjective  scoring  of  the  parameters,  simple  tem¬ 
plates  should  be  developed  with  objective  measures  that  deter¬ 
mine  the  scores.  For  example,  the  CRM  company  could  create 
a  template  for  “one-year  incremental  revenue”  that  includes 
common  values  such  as  the  percentage  of  increase  in  the  cus¬ 
tomer  base  and  incremental  revenue  increase  per  customer. 
A  template  for  the  “customer  service  expense”  parameter 


The  most  important  benefit  of  the 
model  is  that  it  can  shift  with  the 
fortunes  and  goals  of  the  company— 
just  as  stock  analysts  adjust  their 
priorities  as  the  markets  shift. 


Prioritization  in  Action 


To  see  an  explanatory  graphic  that  puts 
the  prioritization  levers  in  perspective, 
go  to  www.cio. com/071506. 

cio.com 
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could  include  “headcount  reduction”  or 
“call  handle  time  reduction,”  which  can 
be  plugged  in  to  determine  value  to  the 
project.  This  value  can  be  translated  to  a 
score  between  1  and  10.  This  will  prevent 
managers  with  a  higher  political  influ¬ 
ence  from  inflating  the  scores  on  their 
projects. 

Once  all  the  projects  are  scored,  they 
can  be  sorted  to  determine  the  projects 
that  make  the  cut.  This  cutoff  point  can 
be  based  on  total  number  of  projects  an 
organization  can  absorb,  total  investment 
funds  available  or  other  constraints  that 
the  company  is  operating  under. 

Manage  the  Model 

Of  course,  all  models  work  well  on  paper. 
No  prioritization  model  is  going  to  be 
completely  accurate,  and  people  will 
inevitably  try  to  manipulate  the  results. 
To  minimize  the  problems,  you  can  take 
a  number  of  basic  steps.  First,  develop 


criteria  to  define  what  constitutes  a  proj¬ 
ect  and  enforce  these  guidelines  so  that 
projects  are  compared  on  equal  footing. 
Having  a  clearly  defined  project  scope 
and  a  project  charter  will  be  necessary 
first  steps  in  enforcing  these  guidelines. 
Second,  don’t  score  every  project— for 
example,  maintenance  projects  (such 
as  database  software  upgrades)  should 
not  be  subjected  to  strategic  analysis. 
Finally,  consider  limiting  the  total  num¬ 
ber  of  projects  a  department  can  request 
within  a  given  year  so  that  the  process  is 
not  flooded  with  requests.  This  limit  has 
to  be  different  for  different  departments 
based  on  business  priorities.  For  exam¬ 
ple,  because  the  CRM  company  is  try¬ 
ing  to  grow  its  customer  base  through 
product  enhancement,  it  will  allocate 
more  investment  dollars  (and  thus  a 
higher  project  request  limit)  to  prod¬ 
uct  development  than  it  will  to  sales  or 
marketing. 


IT  Moves  with  the  Business 

The  most  important  benefit  of  the  model 
is  that  it  can  shift  with  the  fortunes  and 
goals  of  the  company— just  as  stock 
analysts  adjust  their  investment  port¬ 
folio  priorities  as  the  markets  move  up 
or  down. 

Even  better,  the  strategic  levers  give 
CIOs  the  capability  to  prove  the  value 
of  projects  that  may  have  relatively  low 
ROI  while  lowering  the  priority  of  proj¬ 
ects  that  may  show  high  ROI  but  have 
little  strategic  value  to  the  company. 
This  broader  analysis  aligns  IT  strategy 
with  business  strategy  and  ensures  that 
IT  project  prioritization  isn’t  just  about 
projected  cost  savings.  BB 


Sai  Machavarapu  is  a  direc¬ 
tor  of  IT  at  Hoover’s.  Send 
comments  to  Executive 
Editor  Christopher  Koch  at 
ckoch@cio.com. 
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When  a  major  manufacturer  expanded  its  operations  to 
China,  its  IT  solution  facilitated  communications.  Now, 
employees  make  timely  orders  with  global  vendors.  People 
share  information  instead  of  searching  for  it.  And  distant 
offices  feel  like  next-door  neighbors. 

The  net  result  is  a  faster  decision-making  process  that 
saves  the  company  up  to  $400,000  annually.  When  you 
give  your  people  the  right  tools,  success  is  inevitable. 

See  the  full  details  of  this  case  study  at 

microsoft.com/expansion 
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Visibility  for  the  Board 


With  boards  of  directors  under  increased  scrutiny  by  regulators  and  other  entities, 
CIOs  should  consider  creating  a  digital  dashboard  that  gives  them  a  view  into  the  key 
performance  indicators  of  the  business 


A  tad  tired  of  those  demanding  Sarbanes-Oxley 
and  other  compliance  implementations?  Want  to 
dramatically  raise  your  profile  with  your  CEO, 
CFO  and  corporate  counsel?  Do  high-impact 
professional  risks  intrigue  you? 

Then  consider  making  an  offer  your  company’s  board  of 
directors  may  dare  not  refuse.  Create  a  “digital  dashboard”  and 
database  that  puts  all  the  information  a  nonexecutive  director 
might  need  right  at  his  fingertips:  compensation  levels,  capi¬ 
tal  spending  histories,  changes  in  accounting  rules  and  so  on. 
Treat  the  board  like  a  business  unit.  Support  directors  as  if 
they  were  C-level  peers.  Turn  them  into  valued  customers  and 
clients  for  your  IT  shop.  Learn  from  them.  And  yes,  give  them 
tech  support  if  they  ask. 

The  reason  is  as  obvious  as,  say,  an  Enron  trial  in  Hous¬ 
ton.  Litigators  and  regulators  are  making  directors  ever  more 
accountable  for  their  actions  and  inactions.  The  future  of 
global  enterprise  doesn’t  merely  reside  in  better  management 
or  superior  leadership;  it’s  now  contingent  upon  good  gover¬ 
nance.  That’s  not  an  annoying  business  trend— it’s  a  transcen¬ 
dent  legal  principle.  Companies  defy  it  at  their  peril.  And  the 
importance,  liability  and  legal  exposure  of  nonexecutive  direc¬ 
tors  will  be  even  greater  five  years  hence. 

Once  upon  a  time,  independent  directors  with  sterling 
resumes  could  successfully  plead  ignorance  if  their  board- 
approved  mergers,  acquisitions,  hiring,  firing  or  audits  went 
awry.  Today,  they  can  still  plead  ignorance.  However,  they’ll  be 
doing  so  under  oath  before  judges  and  juries  legally  empow¬ 
ered  to  interpret  ignorance  as  negligence.  Ignorance  isn’t  bliss. 
There  are  good  reasons  why  Directors  &  Officers’  insurance 
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Confidence.  When  it  comes  to  security  information  or  anything  else  in  technology,  CDW  delivers  just  that.  That's  why  we  give 
you  a  trained,  dedicated  account  manager  who  knows  your  technology  setup  and  the  products  we  carry.  So  when  you  call  you 
get  faster,  more  insightful  answers.  That's  also  why  we  have  industry-certified  technology  experts  available.  As  well  as  technical 
support  anytime  you  need  it.  Add  in  access  to  the  industry's  largest  in-stock  inventories  and  fast  delivery,  and  you've  got  a 
technology  resource  that's  a  little  different.  It's  one  you  can  count  on. 


The  Right  Technology.  Right  Away. 

CDW.com  •  800.399.4CDW 

In  Canada,  call  888.898.CDWC  •  CDW.ca 
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rates  have  skyrocketed. 

Of  course,  nonexecutive  directors  are  free  to  trust  whatever 
data  they  get  from  the  CEO,  CFO  and  the  auditors.  However, 
if  you  were  on  a  board  that  was  increasingly  being  held  to 
stricter  standards  of  accountability,  wouldn’t  you  like  to  have 
your  own  information  window  into  the  enterprise?  Wouldn’t 
you  like  to  show  a  court  of  law  that  you  demonstrated  fidu¬ 
ciary  “due  diligence”  as  a  director  by  digging  deeply  into  the 
data?  Yes?  Then  “Hello,  CIO!” 

The  harsh  truth  is  that  the  law  is  herding  directors  into 
investing  more  time  and  effort  into  more  serious  governance. 
The  simple  fact  is  that  you  can’t  have  good  governance  without 
good  information. 

The  challenge  is  shockingly  obvious:  CIOs  should  be  taking 
the  lead  in  working  with 
their  CEOs,  CFOs,  cor¬ 
porate  counsels  and,  yes, 
the  auditors,  in  develop¬ 
ing  customized  systems 
to  support  the  board. 

Might  this  put  the 
CEO,  CFO,  corporate 
counsel  and  the  auditors  in  an  awkward  position?  Absolutely. 
Doing  the  right  thing  is  always  risky.  Then  again,  not  doing 
the  right  thing  is  even  riskier. 

Time  to  Show  Initiative 

Let’s  be  blunt:  The  overwhelming  majority  of  the  time,  CIOs 
are  reactors.  They’re  desperately  responding  to  whatever  last- 
minute  requests  come  from  the  lawyers  or  the  investment 
bankers  or  the  CFO  on  some  board-level  issue.  When  they 
successfully  scramble  to  deliver  the  goods  on  deadline  and  in 
desired  formats,  they’re  taken  for  granted.  When  the  data  is 
late  or  missing,  they  get  blamed.  That’s  life,  but  there’s  nothing 
proactive  about  their  role. 

The  rise  of  accountability-driven  governance  is  an  excellent 
opportunity  to  change  that.  Smart  and  gutsy  CIOs  will  make 
the  most  of  it.  They  will  work  with  their  CEOs,  CFOs  and  cor¬ 
porate  counsels  to  work  with  the  board.  They’ll  be  proactive. 
They’ll  informally  chat  with  lawyers  and  nonexecutive  direc¬ 
tors  at  other  firms  to  get  a  sense  of  what  kind  of  customization 
is  necessary.  They’ll  mock  up  some  digital  dashboards  and 
take  them  into,  say,  the  CFO’s  office  and  ask,  “What  do  you 
think?” 

A  CIO  at  a  billion-dollar  U.S.  retailer  did  exactly  that  and 
the  CFO’s  initial  reaction  was  outrage.  Who  the  heck  did  the 
CIO  think  he  was?  The  CEO  was  more  relaxed.  He  calculated 
that  this  proposal  would  make  him  look  smart.  He  had  the 
CIO  present  it  as  a  trial  balloon.  The  directors  didn’t  want 
their  own  system  but  they  did  want  earlier  access  to  the  CFO’s 
numbers.  So  IT  set  up  a  secure  webpage  on  the  corporate  site 
for  the  directors  to  log  into.  Everybody  was  better  off. 


The  key?  The  CIO  demonstrated  initiative  in  a  way  that 
didn’t  threaten  the  CEO  but  addressed  an  unexpressed  desire 
of  the  board.  (The  CFO  was  reportedly  still  annoyed  but  now 
took  the  CIO  much  more  seriously  as  a  corporate  player.)  The 
best  way  to  accomplish  this  is  to  partner  with  one’s  C-level 
peers  and  colleagues  to  better  serve  the  board.  Then  again, 
some  colleagues  are  better  partners  than  others. 

Of  course,  if  the  CIO  really  wants  to  raise  her  profile,  maybe 
she  informally  raises  this  offer  to  a  sympathetic  director  who 
serves  on  the  compensation  or  audit  committee  (the  two 
board  committees  most  likely  to  get  an  independent  director 
in  trouble.)  That’s  truly  high-risk.  Disintermediating  your  col¬ 
leagues  is  corporate  hardball.  If  the  corporate  counsel,  CFO  or 
CEO  isn’t  amenable  to  creative  collaboration  around  “director 


dashboards,”  maybe  that’s  vital  data  for  the  CIO  to  know.  A 
serious  independent  director  might  find  that  informal  con¬ 
versation  useful  and  revealing  too.  So  would  a  director  who’s 
nervous  about  liability.  Can  this  be  done  without  undermin¬ 
ing  the  CEO?  Of  course.  The  better  question  is  whether  your 
company’s  board  understands  and  appreciates  that  it  must 
have  executive  relationships  above  and  beyond  the  counsel, 
the  CEO  and  the  CFO. 

A  healthy  and  productive  relationship  with  the  board  is  a 
reasonable  goal  for  a  world-class  CIO.  Moreover,  in  this  era  of 
complex  compliance  infrastructures  and  global  regulation,  a 
healthy  and  productive  relationship  with  the  CIO  is  an  essen¬ 
tial  goal  for  a  world-class  board. 

For  CIOs,  productive  board-level  relationships  are  essen¬ 
tial  for  professional  development.  While  there’s  a  wealth  of 
management  literature  about  how  CIOs  should  lead  their 
people  and  better  collaborate  across  the  enterprise,  there’s  a 
paucity  of  information  about  “managing  up”— that  is,  what 
role  CIOs  should  play  not  only  in  empowering  C-level  execu¬ 
tives  but  also  in  improving  information,  interaction  and  gov¬ 
ernance  at  the  board  level.  Using  IT  to  help  the  board  manage 
itself  may  be  as  important  for  tomorrow’s  CIO  as  using  IT  to 
cut  costs  and  grow  revenue  for  the  enterprise.  As  crucial  as 
IT  governance  may  be,  corporate  governance  is  even  more 
important.  CIOs  should  recognize  that  and  act 
accordingly.  QE1 


Michael  Schrage  is  codirector  of  the  MIT  Media  Lab’s 
eMarkets  Initiative.  He  can  be  reached  at  schrage@ 
media.mit.edu. 


Let's  be  blunt:  CIOs  are  reactors,  desperately 
responding  to  whatever  last-minute  requests 
come  from  the  lawyers  or  the  investment 
bankers  or  the  CFO  on  some  board-level  issue 
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for  Microsoft  Office  and  SAP. 


Microsoft  and  SAP  have  come  together  in  an  unprecedented  alliance  to  put  the  power  of  SAP  applications  at 
the  fingertips  of  Microsoft  Office  users.  Duet  lets  employees  access  and  interact  with  key  SAP  business  processes 
while  in  their  familiar  Microsoft  Office  environment.  It  was  designed  to  help  boost  productivity  and  increase  policy 
compliance  —  without  additional  training.  Go  online  today  to  view  a  demo  at  duet.com 
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Privacy  Is  Good  Business 

When  it  comes  to  collecting  your  customers’  data,  less  is  usually  more 


t  seems  that  not  a  day  goes  by  without  news  about  lost 
or  stolen  personal  data. 

Some  of  the  most  widely  reported  breaches  involve 
personal  data  collected  and  stored  on  company  net¬ 
works.  Crackers  recently  stole  credit  and  debit  information 
from  a  BJ’s  Wholesale  Club  customer  database,  and  in  another 
incident,  accessed  the  credit  card,  debit  card  and  checking 
account  information  of  more  than  1.4  million  customers  of 
DSW,  a  shoe  discounter. 

The  problem  is  not  limited  to  individual  corporations.  Data 
aggregators  such  as  Acxiom,  ChoicePoint  and  LexisNexis  col¬ 
lect  and  sell  personal  information  on  virtually  every  Ameri¬ 
can.  At  one  time  or  another,  each  of  these  companies  has  had 
to  notify  hundreds  of  thousands  of  individuals  across  the 
country  that  their  personal  information  was  accessed  by  unau¬ 
thorized  individuals.  The  Federal  Trade  Commission  recently 
fined  ChoicePoint  $15  million  after  it  sold  sensitive  personal 
information  to  con  artists  who  then  used  the  data  for  fraudu¬ 
lent  purposes. 

Yet  despite  growing  concerns  about  privacy  and  the  secu¬ 
rity  of  personal  data,  most  American  companies  still  collect 
too  much  personal  information  from  their  customers  without 
giving  them  a  choice  on  how  this  data  is  used,  shared,  sold  or 
retained. 

Opt-Out,  Opt-ln — Same  Difference 

Indeed,  just  over  half  of  large  U.S. -based  companies  offer 
an  opt-out  choice  to  customers,  according  to  a  new  study  by 
the  Ponemon  Institute  (the  company  I  founded).  And  even 
fewer  companies— 23  percent— operate  on  a  consent  or  opt-in 
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YOUR  INTERN  JUST  HAD  A  $100,000  PAYDAY. 
UNFORTUNATELY,  IT  WAS  FROM  THE  SALE  OF  YOUR  DATA. 

If  your  data  could  talk,  it  would  tell  you  that  it  could  be  stolen  from  right  under  your  nose.  If  your  enterprise  suffers  a 
data  breach,  are  you  ready?  That's  why  there's  EpiForce™  from  Apani  Networks™.  It's  built  from  the  ground  up  to 
secure  data  inside  the  perimeter.  Plus,  it's  highly  scalable,  centrally  managed  and  supports  multiple  OS  platforms. 
EpiForce  can  help  secure  your  sensitive  data  from  a  threat  that  could  be  just  around  the  corner.  A _ _ +™ 

Apani 


To  learn  more  about  insider  threats,  get  a  free  copy  of  "The  Insider  Threat  Benchmark  Report' 
published  by  the  AberdeenGroup.  Get  a  free  copy  at  www.apani.com/cio-insider 


Larry  Ponemon  keynote 


approach.  (With  an  opt-in  policy,  companies  will  not  collect 
personal  information  unless  their  customers  specifically  con¬ 
sent  or  opt  in.) 

Even  if  companies  do  offer  opt-out,  it  can  be  a  very  frustrat¬ 
ing  experience— much  like  calling  customer  service  at  your 
telephone  company  to  complain  about  their  billing  error. 
And  there  is  no  guarantee  that 
personal  information  will  actually 
be  stricken  from  the  company’s 
customer  contact  database.  Not 
only  are  Americans  increasingly 
worried  their  personal  data  may 
fall  into  the  wrong  hands  but  they 
are  also  becoming  more  anxious  about  omnipresent  surveil¬ 
lance  of  their  personal  lives  by  the  government.  In  January, 
the  Ponemon  Institute  conducted  a  survey  on  whether  search 
engine  Google  should  release  Internet  search  information  to 
the  federal  government.  More  than  56  percent  of  respondents 
in  our  study  said  that  Google  should  not  release  Web  search 
information  to  the  government. 

Some  recent  surveys  indicate  that  privacy  concerns  are 
behind  the  recent  plateau  in  the  numbers  of  people  who  bank 
online.  And  privacy  experts  say  that  they  foresee  an  increas¬ 
ing  number  of  lawsuits  against  corporations  from  angry 
consumers  whose  personal  data  has  been  breached.  Recent 
government  enforcement  actions  have  also  raised  the  bar 
for  companies.  In  its  ruling  against  DSW,  the  FTC  required 
the  shoe  retailer  to  establish  a  comprehensive  information 
security  program  that  includes  administrative,  technical  and 
physical  safeguards. 

WheretheCIOFitsIn 

I  believe  that  it  is  “good  business”  for  American  companies 
to  be  more  responsive  to  customer  and  employee  privacy 
concerns.  After  all,  when  a  company  succeeds  in  creating  a 
trusted  relationship,  many  customers  do,  in  fact,  appreciate 
the  personalization  of  marketing  messages  that  making  their 
personal  data  available  can  enable  and  are  therefore  willing 
to  share  more  information  about  their  purchasing  habits  and 
lifestyle. 

As  the  chief  information  steward  for  their  companies,  CIOs 
are  in  a  position  to  take  a  leadership  role  here.  When  all  is  said 
and  done,  you  are  most  likely  the  executive  who  has  to  create  a 
cohesive  data  protection  strategy  within  your  enterprise  and, 
if  your  company  is  outsourcing,  outside  it  as  well.  It  is  up  to 
you  and  other  top  executives  to  ensure  that  all  of  your  busi¬ 
ness  partners  maintain  the  same  level  of  vigilance  as  you  do 
over  the  information  entrusted  to  them. 

What  You  Can  Do  to  Safeguard  the  Data 

One  of  the  lessons  learned  from  recently  publicized  data 
breaches  is  that  the  failure  to  properly  secure  personal  infor¬ 


mation  can  be  very  costly  in  terms  of  lawsuits,  fines,  dimin¬ 
ished  reputation  and  customer  churn.  Hence,  it  is  always  a 
good  idea  for  companies  to  be  honest  and  open  with  people 
whose  data  has  been  entrusted  to  them.  That  means  posting 
privacy  policies  that  are  easy  to  understand.  Remember,  not 
everyone  has  a  law  degree.  Transparency  also  requires  the 


company  to  explain  clearly  how  personal  information  is  being 
used  and  why  it  may  be  shared. 

CIOs  should  also  consider  installing  technologies  that  make 
it  easier  to  manage  customers’  privacy  preferences  and  track 
illegal  data  movement.  Effective  use  of  these  technologies  will 
promote  a  higher  sense  of  confidence  that  your  organization  is 
committed  to  protecting  privacy,  thus  protecting  your  brand 
or  reputation.  As  you  put  these  technologies  in  place,  keep  in 
mind  that  not  all  personal  information  is  considered  equal  in 
terms  of  potential  sensitivity.  CIOs  should  know  where  in  the 
organization  the  most  sensitive  types  of  personal  data  (Social 
Security  numbers,  credit  card  accounts  and  health  records) 
reside  and  make  sure  this  data  is  secured  at  a  higher  level  than 
other  types  of  information. 

IT  executives  should  also  make  sure  that  their  companies 
do  not  collect  too  much  information.  This  is  tricky,  since  mar¬ 
keting  departments  often  have  ambitious  goals  for  targeting 
customers  to  increase  revenue  and  that,  in  turn,  results  in 
pressure  to  collect  as  much  information  as  possible.  In  the  pri¬ 
vacy  game,  however,  less  should  always  be  preferred  to  more. 
The  key  is  to  collect  just  what  is  needed  to  get  the  job  done. 
In  addition,  CIOs  need  to  take  steps  to  ensure  that  personal 
data  the  company  collects  is  accurate  and  current.  One  way 
to  improve  accuracy  is  to  provide  customers  with  the  ability 
to  access  and,  if  necessary,  correct,  personal  information  col¬ 
lected  about  them.  And  when  personal  data  is  no  longer  rel¬ 
evant  (or  required  by  law),  companies  should  get  rid  of  it.  The 
storage  of  stale  or  outdated  personal  information  is  almost 
always  a  threat  to  privacy. 

The  CIO  must  be  proactive  in  making  sure  the  organization 
can  “walk  the  talk”  when  it  comes  to  its  privacy  and  data  pro¬ 
tection  commitments.  While  this  is  a  difficult  and  politically 
risky  task,  in  the  end  your  company  will  thank  you  for  taking 
on  this  leadership  role.  BQ 


Larry  Ponemon  is  founder  and  president  of  the 
Ponemon  Institute,  a  research  think  tank  dedicated 
to  privacy  management.  He  can  be  reached  at  larry@ 
ponemon.org. 


It  is  always  a  good  idea  for  companies  to  be 
honest  and  open  with  people  whose  data 
has  been  entrusted  to  them. 
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Mexico  is  close  and  open 
to  your  IT  needs  365  days  a  year. 


Profit  from  all  the  benefits  your  company  will  enjoy  resulting  from  the  nearness  between  our  countries: 


Always  Near  Your  Business 


•Selection  of  services  from  application  developmentto  maintenance  and  BPO  services  to  contact  centers 
to  world-class  data  center  facilities 

•  Large  source  of  skilled  IT  professionals 

•  World-class  technological  infrastructure  for  IT  Services 

•  Exceptional  location  for  remote  real-time  IT  engagements 

•The  comfort  of  coming  for  business  and  getting  back  home  for  dinner 


www.mexico-it.com 


We  are  ready.  The  choice  in  IT  Services  is  closer  than  ever. 
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Americans 
have  been 
hogging  Internet 
addresses for 
decades,  leaving 
late-comerslike 
China  to  divvy  up 
the  few  remaining 
slivers.  But  China  is 
fighting  back  by 
vaulting  to  an 
addressing  stan¬ 
dard  that  could 
rewrite  the  rules  of 
the  Internet— and 
business  innova¬ 
tion— for  decades 
to  come. 

BY  BEN  WORTHEN 


Reader  ROI 

::  Why  the  Internet  is  running 
out  of  address  space 

::  How  IPv6  could  save  30  percent 
on  infrastructure  costs 

::  How  to  avoid  an  upgrade  crisis 


a  Friday  night  in  mid-April,  a  gang  of 
■  Jnv  \  I  Friendlies,  the  multicolored,  panda- 
SB  H  cum-Teletubby-like  creatures,  which 

m  are  the  official  mascots  of  the  2008 

Olympics,  mill  about  awkwardly,  waving  to  confused  tourists 
stumbling  out  of  the  bars  that  ring  Houhai  Lake  in  Beijing.  Sev¬ 
eral  miles  away,  construction  crews  are  working  around  the  clock 
on  the  Olympic  stadium  and  other  venues,  trying  desperately  to 
keep  to  their  schedules  for  the  opening  ceremony  two  years  away. 


Meanwhile,  out  of  sight,  in  research  labs  throughout  China,  engineers  are  busy 
working  on  another  project  that  the  Chinese  government  plans  to  unveil  at  the 
Olympics:  China’s  Next  Generation  Internet  (CNGI),  a  faster,  more  secure,  more 
mobile  version  of  the  current  one.  And  unlike  the  Friendlies  and  the  stadiums, 
which  the  world  will  forget  as  soon  as  the  games  end,  CNGI’s  impact  will  be  felt 
for  decades. 

CNGI  is  the  centerpiece  of  China’s  plan  to  steal  leadership  away  from  the  United 
States  in  all  things  Internet  and  information  technology. 

The  strategy,  outlined  in  China’s  latest  five-year  plan,  calls  for  the  country  to 
transition  its  economy  from  one  based  almost  entirely  on  manufacturing  to  one 
that  produces  its  own  scientific  and  technological  breakthroughs— using  a  new 
and  improved  version  of  today’s  dominant  innovation  platform,  the  Internet. 
“CNGI  is  the  culmination  of  this  revolutionary  plan”  to  turn  China  into  the  world’s 
innovation  capital,  says  Wu  Hequan,  vice  president  of  the  Chinese  Academy  of 
Engineering  and  the  chairman  of  the  CNGI  Expert  Committee,  the  group  oversee¬ 
ing  the  project.  “We  will  use  it  as  a  way  to  break  through  and  be  competitive  in  the 
global  economic  market.” 

The  technology  at  the  heart  of  CNGI  is  an  emerging  communication  standard  called 
Internet  protocol  version  6  (IPv6).  The  Internet  protocol  is  the  Internet’s  version  of  a 
postal  envelope,  containing  information  such  as  the  destination  and  return  addresses, 
and  details  about  a  package’s  contents.  The  current  standard,  IPv4  (IPv5  never  made 
it  out  of  the  lab),  doesn’t  have  enough  unique  addresses  for  every  would-be  user  in  the 
world  to  connect  to  the  Internet.  IPv6  solves  this  problem,  and  is  also  more  secure  and 
efficient  than  its  predecessor.  For  these  and  other  reasons,  most  experts  agree  that  a  shift 
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to  an  IPv6-based  Internet  is  inevitable. 

China  is  betting  that  by  moving  to  the  next-generation  Internet 
before  the  rest  of  the  world,  China’s  researchers,  academics  and 
entrepreneurs  will  be  the  first  ones  to  develop  applications  and  ser¬ 
vices  that  take  advantage  of  the  new  capabilities.  (China  isn’t  alone 
in  this  thinking.  Japan  and  Korea  have  also  launched  national  initia¬ 
tives  to  move  to  IPv6.)  If  all  goes  according  to  plan,  those  services 
will  be  commercialized,  making  China  home  to  the  next  wave  of 
eBays  and  Googles.  But  China  is  also  working  on  ways  to  use  IPv6 
to  enhance  its  now  infamous  control  over  Internet  traffic  into  and  out 
of  the  country— which  could  have  dramatic  security  implications  for 
the  United  States  (see  “A  New  Weapon  for  Control  and  Intelligence?” 
below). 


Call  CNGI  the  first-mover  advantage  to  end  all  first-mover 
advantages.  “[China  is]  looking  to  leapfrog  the  U.S.,”  says  Michael 
Gallagher,  who  was  assistant  secretary  of  commerce  for  commu¬ 
nications  and  information,  and  President  Bush’s  top  adviser  on 
Internet  issues  before  joining  the  law  firm  Perkins  Coie  in  Feb¬ 
ruary.  According  to  Chinese  and  U.S.  sources  familiar  with  the 
project,  the  Chinese  government  has  already  invested  close  to 
$200  million  in  CNGI  and  has  created  a  special  office  of  the  State 
Council  dedicated  solely  to  the  project.  China’s  major  telecom¬ 
munications  companies,  each  of  which  is  responsible  for  building 
a  portion  of  the  network,  have  also  spent  hundreds  of  millions 
of  dollars  so  far.  Today,  CNGI  connects  100  universities,  100 
research  institutes  and  100  companies  in  20  cities.  At  the  Bei¬ 
jing  Olympics  in  2008,  China  plans  to  use  CNGI 
for  everything  from  broadcasting  the  events  to 
controlling  the  Olympic  facilities. 

THE  COMING  THREAT 

he  United  States  is  still  the 
undisputed  leader  when  it 
comes  to  the  Internet.  “[But] 
we  cannot  let  our  current 
success  become  a  liability, 
with  a  continued  reliance  on 
the  present  protocol,  while 
everyone  else  moves  forward,”  says  Rep.  Tom  Davis 
(R-Va.),  chairman  of  the  House  Committee  on  Gov¬ 
ernment  Reform. 

But  that’s  exactly  what’s  happening,  in  large 
part  because  few  people  in  the  United  States  know 
the  threat  exists.  “Over  time  IPv6  could  revolution¬ 
ize  what  we  can  do  with  the  Internet,”  says  David 
Powner,  director  of  information  technology  man¬ 
agement  issues  for  the  Government  Accountability 
Office.  “My  concern  is  that  we  will  get  behind.” 

If  China  gets  too  big  a  head  start,  U.S.  CIOs 
could  be  in  the  unfamiliar  position  of  having  to 
play  catch  up  to  the  rest  of  the  world— while  pay¬ 
ing  as  much  as  30  percent  more  to  manage  their 
networks,  according  to  estimates  by  the  National 
Institute  of  Standards  and  Technology.  Worse, 
organizations  that  lag  behind  the  world  in  IPv6 
adoption  will  be  more  vulnerable  to  hackers  and 
other  security  threats.  According  to  research  by 
the  U.S.  Department  of  Commerce,  the  cost  for 
an  enterprise  to  build  an  IPv6  infrastructure  is 
minimal  if  it  is  spread  out  over  time  as  part  of 
the  normal  technology  refresh  cycle.  However, 
companies  that  wait  until  demand  for  IPv6  ser¬ 
vices  emerge— either  from  overseas  business 
partners  or  U.S.  customers— could  face  a  mas¬ 
sive  onetime  hit  in  the  ballpark  of  what  it  cost  to 
fix  the  Y2K  problem. 


A  NEW  WEAPON 
FOR  CONTROL  AND 
INTELLIGENCE? 

China’s  NextGeneration  Internet  could  further  tighten 
its  control  over  Internet  access  and  traffic  while  offer¬ 
ing  a  strategic  advantage  in  foreign  intelligence 

China's  censorship  of  the  Internet  and  its  tight  control  over  traffic 
in  and  out  of  the  country  are  well  known.  Internet  protocol  version  6  has  , 
the  potential  to  give  China  an  even  tighter  grip.  Because  each  Internet- 
connected  device  has  a  unique  IP  address,  it  could  be  easier  for  the  govern¬ 
ment  to  track  users  who  post  pro-democracy  messages  online  or  who  try  to 
use  the  Web  to  organize  protests.  Members  of  the  international  IPv6  com¬ 
munity  say  that  every  IPv6-enabled  device  will  come  with  two  addresses 
that  a  user  can  flip  between:  an  authenticated  one  for  transactions  and  an 
anonymous  one  for  Web  browsing  and  other  activities.  But  because  next- 
generation  Internet  service  is  not  commercially  available  in  China  yet,  it 
remains  to  be  seen  what  the  real-world  implementation  will  look  like. 

China's  NextGeneration  Internet  (CNGI)  has  U.S.  national  security  impli¬ 
cations  as  well.  While  the  level  of  Chinese  military  involvement  in  CNGI  is 
unclear,  the  People’s  Liberation  Army  has  designed  its  own  IPv6  router,  and 
a  recent  China  IP  Council  white  paper  mentions  that  IPv6  networks  have 
“military  and  intelligence"  uses.  Unrestricted  Warfare,  a  widely  translated 
treatise  on  military  doctrine  written  by  two  People’s  Liberation  Army  offi¬ 
cers,  calls  for  China  to  engage  the  West  in  nontraditional  combat,  and  sug¬ 
gests  tactics  such  as  computer  hacking  and  cyberterrorism. 

Meanwhile,  if  China  moves  to  an  IPv6  network  while  the  United  States 
is  still  running  IPv4,  Internet  traffic  coming  from  China  will  be  impos¬ 
sible  to  track  back  to  its  source,  says  James  Mulvenon,  deputy  director 
of  the  Center  for  Intelligence  Research  and  Analysis,  which  advises  the 
U.S.  intelligence  community.  “Imagine  if  you  are  running  an  army  net¬ 
work  at  Fort  Hood  and  you  detect  hostile  packets,”  he  says.  If  the  packets 
are  coming  from  or  through  China,  “you  can't  tell  anything  about  them. 

It  turns  China  into  a  big  anonymizer.”  -B.W. 
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And  while  China’s  first-mover  advantage  is  by  no  means  a 
given,  China  has  already  established  itself  as  the  world’s  leader 
for  IPv6,  and,  accordingly,  is  positioned  in  IPv6-related  stan¬ 
dards  organizations.  That  could  mean  that  the  next-generation 
Internet  is  China-centric,  the  way  the  rest  of  the  world  feels  the 
current  one  is  U.S.-centric.  “We  used  to  be  behind  on  the  Inter¬ 
net,”  says  Xiang  Yangchao,  executive  vice  president  of  Digital 
China  Networks.  “But  we  hope  that  we  can  become  the  leader  of 
the  IPv6  Internet.” 

“The  Chinese  are  competing  with  us,”  says  James  Lewis,  senior 
fellow  at  the  Center  for  Strategic  and  International  Studies.  “We 
need  to  recognize  that  and  figure  out  how  we  are  going  to  com¬ 
pete  with  them.” 

WHY  CHINA  NEEDS  A 
NEW  INTERNET 


The  story  of  China’s  Next  Generation  Internet 

project  began  here  in  the  United  States  in  1983, 
when  the  Internet,  a  Department  of  Defense 
project  connecting  a  select  group  of  academ¬ 
ics  and  researchers,  adopted  an  addressing 
system,  IPv4,  so  that  computers  connected  to 
the  Internet  could  each  have  a  unique  identity 
for  recognizing  and  communicating  with  each  other.  The  addressing 
scheme,  which  uses  a  series  of  four  decimal  values,  each  of  which  can 
be  a  number  from  0  to  255  (also  known  as  32-bit  addressing),  has  a 
total  of  4.3  billion  possible  addresses.  In  1976,  when  computer  engi- 


total,  serving  an  online  population  of  about  200  million. 

That  has  left  relative  latecomers  to  the  Internet,  like  China,  in 
a  bind.  China,  which  is  expected  to  surpass  the  United  States  as 
the  world’s  biggest  Internet  user  later  this  year,  has  just  2  per¬ 
cent  of  the  world’s  IP  addresses,  or  around  60  million— about 
as  many  as  Stanford  University.  To  its  credit,  the  Internet  Engi¬ 
neering  Task  Force,  the  organization  responsible  for  setting 
standards  on  the  Internet,  saw  this  problem  coming  a  long  time 
ago  and  formally  adopted  a  replacement  standard,  IPv6,  in  1994. 
IPv6  solved  the  address  shortage  by  increasing  the  number  of 
decimal  values  in  each  address  from  four  to  16  (or  128  bits), 
resulting  in  a  near  infinite  number  of  combinations— enough 
addresses  for  every  grain  of  sand  on  the  planet,  for  example, 
or  for  every  person  alive  to  have  about  50  octillion  unique  IP 
addresses.  IPv6  can  also  recognize  IPv4  traffic,  allowing  net¬ 
work  operators  to  phase  out  the  old  standard  over  time. 

But  before  IPv6  could  gain  any  traction,  engineers  devel¬ 
oped  a  workaround  to  IPv4’s  address  limitations  so  they 
could  avoid  rebuilding  their  Internet  networks.  Dynamically 
assigned  IP  addresses  allow  ISPs  to  give  a  user  a  temporary 
address  that  is  reclaimed  at  the  end  of  an  online  session,  and 
Network  Address  Translation  (NAT)  devices  allow  multiple 
users  to  connect  to  the  Internet  through  a  single  IP  address. 
This  saved  the  world  from  a  costly  infrastructure  upgrade, 
“but  NAT  also  made  the  Internet  more  complicated 
and  more  fragile,”  says  Nurani  Nimpuno,  out¬ 
reach  coordinator  for  APNIC,  the  registry 
that  covers  the  Asia-Pacific  region.  NAT,  Chi- 


Your  Hidden  IPv6  Network 


Are  you  building  an  IPv6  network  without  even  knowing  it? 


If  you’ve  bought  any  new  network  equipment  over  the  past  few  years,  then  chances 
are  yes.  Most  commercially  available  routers  and  switches  recognize  both  IPv4  and 
IPv6  traffic,  as  do  Windows,  Linux  and  Mac  OS.  But  that  doesn’t  mean  your  network 
is  IPv6  ready— that  would  require  a  full  network  redesign.  Meanwhile,  don’t  ignore 
the  IPv6  capabilities  you  may  already  have.  Most  applications,  including  network 
monitoring  software,  won’t  register  a  user  connecting  with  an  IPv6  address,  making 
it  possible  for  hackers  to  enter  the  network  undetected.  Disable  the  IPv6  capabili¬ 
ties  wherever  possible  until  you  are  ready  for  the  transition.  -B.W. 


neers  Vint  Cerf  and  Robert  Kahn  developed  IPv4,  that  seemed  like 
plenty.  “[A  longer  address]  sounded  just  a  little  excessive  in  1976,” 
Cerf  said  at  a  government  roundtable  in  2004.  “I  mean,  after  all,  [the 
Internet]  was  an  experiment.  So  I  thought,  well,  4.3  billion  addresses 
should  be  enough  for  an  experiment.” 

At  that  time,  the  Internet  was  a  mostly  American  phenom¬ 
enon,  so  U.S.  universities,  commercial  ISPs  and  some  companies 
gobbled  up  large  blocks  of  IP  addresses  on  a  first  come,  first 
served  basis.  Today,  U.S.-based  organizations  have  more  than 
1.2  billion  IP  addresses,  close  to  30  percent  of  the  theoretical 


na’s  dominant  strategy  for  parsing  out  precious  IP  addresses, 
introduces  more  intermediate  connections  between  computer 
users  and  the  Internet,  increasing  susceptibility  to  slowdowns 
and  interruptions  and  complicating  high-bandwidth,  real-time 
services  like  voice  over  IP  or  streaming  video. 

Given  that  China  will  have  almost  twice  as  many  broadband 
users  as  the  United  States  by  the  end  of  2007,  the  sense  of 
injustice  among  China’s  Internet  officials  is  palpable.  “When 
26  Chinese  share  one  Internet  protocol  address,  while  each 
American  possesses  six  IP  addresses...this  is  the  quandary 
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IBM  is  helping  a  heavy  equipment  manufacturer  identify  ways  to  cut  IT  spending 
by  $200  million  over  the  next  two  years.  How?  By  helping  its  CIO  view  the  entire  IT 
infrastructure,  right  down  to  its  sprockets  and  ball  bearings.  Then  they  can  identify 
which  parts  are  delivering  value  and  which  aren’t  and  make  changes  to  improve 
business  performance.  Want  innovation  for  value?  Talk  to  the  innovator’s  innovator. 
Call  on  IBM.  To  learn  more  about  what  an  IBM  team  can  do  for  you,  or  to  download  a 
copy  of  our  report  The  CIO  Innovation  Agenda,  visit  ibm.com/innovation/cio 

what  makes  you  special? 
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facing  China  in  the  IPv4  era,”  Zhao  Houlin,  director 
of  the  International  Telecommunications  Union,  said 
in  2005.  The  bottom  line  for  China,  says  Jiang  Lintao, 
chief  engineer  at  the  China  Academy  of  Telecommunica¬ 
tions  Research,  is  that  “We  cannot  survive  without  IPv6.” 


THE  LEAPFROG  EFFECT 

Latif  Ladid,  organizer  of  the  IPv6  Global 
Summit,  the  world’s  largest  IPv6  con¬ 
ference,  recalls  being  unable  to  order  a 
drink  at  a  cafe  inside  the  Beijing  Inter¬ 
national  Convention  Center  when  the 
conference  was  first  held  there  in  2004. 
In  April  2006,  sitting  at  the  same  cafe, 
the  conference  humming  100  feet  away,  he  had  no  problem. 
“Now  everyone  speaks  English,”  he  says. 

And  that’s  just  the  beginning  of  China’s  accommoda¬ 
tions  to  the  West. 

A  bellhop  at  one  of  the  conference  hotels  has  adopted 
a  Western  alias,  Harrison,  to  save  foreign  guests  the 
trouble  of  having  to  decipher  and  pronounce  his  real 
name.  A  Chinese  technology  PR  woman  changed  her 
Western  pseudonym  from  Daisy  to  Edelweiss  when  she 
realized  she  had  misidentified  her  favorite  flower  and 
finally  settled  on  Dandelion  after  surmising  that  Edel¬ 
weiss  was  too  hard  to  pronounce. 

It’s  all  part  of  China’s  plan  to  integrate  with— and  com¬ 
pete  against— the  West,  says  Ladid,  pointing  to  the  2,000- 
plus  Chinese  engineers  on  hand  at  the  conference  to  learn 
about  IPv6.  They  are  the  soldiers  in  the  battle  for  the  next 
Internet,  the  ones  who  will  build  China’s  new  network 
and  design  the  services  that  take  advantage  of  it. 

The  innovation  potential  provided  by  IPv6  is  enor¬ 
mous.  Every  device,  from  cell  phones,  to  street  lights,  to 
a  household  thermostat,  can  have  its  own  unique  posi¬ 
tion  on  the  Internet  and  be  connected  all  the  time.  Util¬ 
ity  companies  will  be  able  to  read  meters  remotely  over 
the  Internet.  Consumers  parked  outside  a  grocery  store 
will  be  able  to  download  shopping  lists  from  their  Inter¬ 
net-connected  refrigerators  to  their  BlackBerrys.  Since 
every  computer  will  have  its  own  permanent  IP  address, 
users  will  be  able  to  authenticate  the  source  of  e-mails  or 
other  requests,  providing  the  means  to  track  and  prevent 
today’s  hacking,  spam  and  phishing  schemes. 

For  defense  strategists,  IPv6  is  science  fiction  come 
to  life.  John  Stenbit,  former  CIO  of  the  Department  of 
Defense,  says  that  every  soldier,  spy  plane  and  even 
every  bullet  will  eventually  have  its  own  IP  address,  giv¬ 
ing  the  military  an  incredible  level  of  real-time  visibility 
into  combat  zones. 

The  first  services  built  with  IPv6  in  mind  are  just  hitting 
the  market.  Microsoft’s  upcoming  Vista  operating  system, 
for  example,  includes  a  feature  where  two  IPv6  compat- 
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THE UPS AND 
DOWNS  OF  IPv6 
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★ 
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Internet  protocol  version  6  will  give  every  computer,  cell 
phone  and  radio  frequency  identification  tag  its  own  unique 
address  on  the  Internet,  opening  up  vast  potential  for  new  types 
of  communication  and  innovation.  But  getting  there  isn’t  free. 

IPv6  is  the  nine-digit  ZIP  code  of  the  Internet:  It  vastly 
expands  the  potential  to  pinpoint  communications  on  the 
Internet.  Every  device— from  cell  phones  to  refrigerators  to 
bullets— will  have  its  own  address,  which  means  engineers 
can  build  a  multitude  of  new  applications  and  services  for  this 
greatly  expanded  and  constantly  connected  network.  But  the 
good-enough  nature  of  today’s  Internet  and  the  cost  of  moving 
to  IPv6  could  mean  that  adoption  is  as  halfhearted  as  it  was  for 
those  longer  ZIP  codes.  Here  are  the  major  benefits  and  costs: 


Benefits 

★  Ubiquitous  connectivity.  Every  device  on  the  Internet  gets  its  own  IP 
address  and  can  be  constantly  connected— without  requiring  human  intervention. 
This  will  spurthe  development  of  new  applications  and  services  that  take  advantage 
of  the  new  capabilities. 

★  Reduced  network  administration.  Since  every  device  on  an 
IPv6  network  can  connect  directly  to  the  Internet,  there  is  no  need  to  set  up  and 
maintain  internal  networks.  And  since  IPv6  devices  can  come  online  them¬ 
selves,  configuration  becomes  much  easier.  The  Department  of  Commerce 
estimates  that  network  management  costs  will  drop  30  percent  thanks  to  IPv6. 

★  Improved  security.  Longer  IP  addresses  mean  that  each  device  has  a 
unique  identifier.  This  will  allow  for  device  and  user-level  authentication-mean¬ 
ing  spammers  and  hackers  can’t  hide  behind  constantly  shifting  IP  addresses, 
as  they  do  today.  The  security  paradigm  will  have  to  change  from  firewall-centric 
to  application-centric,  but  once  it  does  the  Internet  will  be  a  much  safer  place. 

★  More  efficient.  IPv6  is  designed  so  that  the  first  packet  in  a  stream  of 
data  has  all  the  header  information  for  the  entire  cluster.  The  result  is  that  IPv6 
transmission  takes  up  less  bandwidth  than  IPv4  transmissions. 


Costs 

★  Equipment  replacement.  Overtime,  CIOs  will  need  to  replace  all  their 
IP-enabled  devices,  including  routers  and  switches,  printers  and  PCs,  with  IPv6- 
compatible  equipment.  If  they  do  it  as  part  of  the  normal  hardware  refresh  cycle  then 
the  extra  cost  will  be  negligible.  If  they  wait  until  there's  a  need  to  make  a  sudden, 
wholesale  swap-out,  the  new  hardware  alone  could  amount  to  a  onetime  multimil- 
lion-dollar  hit  for  large  companies. 

★  Application  rewrites.  Applications  will  need  to  be  rewritten  for  IPv6 
users.  It  is  unclear  how  costly  this  will  be-it  depends  on  the  application.  But 
do  not  buy  a  package  or  upgrade  to  a  new  version  without  first  finding  out 
what  your  vendor’s  IPv6  transition  plan  is. 

★  Retraining.  Network  administrators  will  need  to  be  trained  in  the  new  environ¬ 
ment:  A  full-time  IPv6  network  specialist  will  cost  around  $165,000  a  year,  according 
to  Department  of  Commerce  estimates. 

-B.W. 
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Blitzing  and  Intercepting 
Hard-to-Tackle  IT  Problems 


Integrity  Management:  A  Free 
Safety  Behind  Your  Front  Line 


NO  MATTER  HOW  GOOD 

your  front  line  and  linebackers,  free 
safeties  in  football  are  fundamental. 
They  often  call  defensive  plays.  They 
blitz  in  with  their  big  picture  view  of 
the  playing  field  when  they  see  some¬ 
thing  developing  and  make  tackles  behind  the  line  of 
scrimmage.  And  they  make  interceptions  that  save  the 
game.  So  it  is  with  Integrity  Management. 

When  you’ve  already  got  a  firewall,  a  disaster  recovery 
plan,  monitoring  tools,  conference  call  capability  for 
troubleshooting,  redundant  hardware,  change  manage¬ 
ment,  a  BSM  tool,  and  a  trouble  ticket  system,  why  on 
earth  would  you  need  an  Integrity  Management  solu¬ 
tion?  For  the  same  reason  you  need  a  free  safety  with  his 
whole-field  view  backing  up  your  front  line. 

Integrity  Management  fundamentally  improves 
availability  and  service  levels  by  augmenting  the  tools 
and  procedures  you  already  have  in  place.  Given  that 
your  organization’s  productivity,  revenue,  and  the  value 
of  your  brand  are  at  stake,  it  is  your  fiduciary  responsi¬ 
bility  to  add  Integrity  Management  to  your  defense. 
Fundamental  Need:  Detecting  Anything  Abnormal 
Integrity  Management  is  fundamental  because  one  of  its 
core  functions  is  to  detect  whether  your  IT  systems  are 
running  normally  or  are  being  disrupted.  The  reality  is 
that  no  matter  how  many  defensive  systems  and  process¬ 
es  you  put  in  place,  things  slip  through.  Integrity 
Management  detects  the  first  signs  of  the  abnormal 
behavior  that  results  when  a  Trojan  horse  slips  through 
system  security.  Or  the  bad  change  is  installed.  Or  when 
the  application  server  process  queue  grows  because  a 
broken  index  is  slowing  the  database  server.  Or  when  the 
load  balancer  sends  all  traffic  to  the  dead  authentication 
server  process  because  that  server  is  least  busy.  Or  what¬ 
ever  it  is  that’s  just  not  normal. 

Most  of  the  issues  above  underscore  a  tenet  of  Integrity 
Management,  that  system  interdependencies,  not  individ- 
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ual  component  failures,  are  the  primary  threat  to  enterprise  IT  availability. 

In  order  to  understand  how  Integrity  Management  augments  existing 
availability  tools,  keep  in  mind  the  holistic  nature  of  the  early  warnings 
Integrity  Management  provides.  Like  a  free  safety,  Integrity  Management  sees 
the  play  developing  and  acts.  To  shift  metaphors  from  football  to  flooding, 
detection  of  water  spilling  over  the  levee  is  insufficient.  Integrity  Management 
picks  up  the  early  cracks.  Not  in  order  to  send  a  storm  of  “new  crack”  alerts, 
but  in  order  to  predict  the  failure  of  the  entire  levee  system  ahead. 

Integrity  Management  Strengthens  Existing  Tools 

Integrity  Management  doesn’t  replace  existing  tools:  it  strengthens  what  you 
already  have  in  place.  There  are  more  examples,  which  we  leave  you  to  fill  in 
as  an  exercise,  but  here  are  a  few: 

When  The  Firewall  Fails,  Integrity  Management  Kicks  In 

Firewalls  and  other  perimeter  defenses  are  absolute  necessities.  But  when  they 
come  under  attack,  an  Integrity  Management  solution  notices  their  abnormal 
load.  That  means  you  can  gird  for  possible  success  of  the  attack  or  take  appro¬ 
priate  action  if  the  abnormal  firewall  load  is  slowing  a  critical  IT  service. 

Integrity  Management  is  even  more  vital  when  a  malevolent  visitor  gets 
through  or  is  on  the  inside  to  begin  with.  The  fundamental  nature  of  Integrity 
Management  is  such  that  it  will  pick  up  abnormal  behavior  that  occurs  after 
the  breach.  Think  of  Integrity  Management  as  the  motion  detector  portion  of 
a  very  smart  burglar  alarm,  which  looks  not  only  for  perimeter  penetration 
but  also  unexpected  movement  once  the  burglar  is  inside. 
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Not  Just  Disaster  Recovery: 

Everyday  Recovery 

Traditional  thinking  about  availability  and 
business  continuity  focuses  on  catastrophic 
events,  and  it’s  clear  why  such  “insurance”  is 
needed.  What  may  be  less  clear  is  that  similar 
focus  is  warranted  for  the  many  short-term 
disruptions  to  availabili¬ 
ty,  whose  aggregate  like¬ 
ly  cost  exceeds  that  of 
the  rare  events  that 
totally  disrupt  or  dis¬ 
place  IT  operations. 

Rather  than  addressing 
the  vague  potentiality  of 
disaster,  Integrity 
Management  mitigates 
the  risk  of  the  disrup¬ 
tions  organizations 
experience  frequently. 

Besides  mitigating 
the  risk  from  everyday 
outages  and  service  level  issues,  Integrity 
Management  backs  up  your  business  con¬ 
tinuity  plan  should  disaster  strike. 
Integrity  Management  can  provide  visibil¬ 
ity  into  your  processes  for  backup  and  for 
failing  over  to  a  redundant  infrastructure, 
then  focus  on  maximizing  availability 
until  your  redundancy  is  restored. 
Monitoring  Tools  Miss 
Emerging  Abnormalities 
Traditional  monitoring  tools  are  valuable: 
they  tell  you  when  you  have  a  problem  on  a 
device.  But  it’s  not  enough  to  send  an  alert 
when  a  “game  over”  static  threshold  is  violat¬ 
ed.  True  effectiveness  demands  picking  up 
the  first  sign  of  abnormality  that  indicates  a 
problem  lies  ahead.  But  detecting  abnormal 
metrics  is  difficult  because  what’s  “normal” 
changes  based  on  the  dynamics  of  the  end- 
to-end  system  load.  Integrity  Management 
solutions  learn  what’s  normal  over  time  in 
order  to  set  meaningful  thresholds  that  adapt 
to  changing  conditions.  You  get  a  predictive 
alert  at  the  first  sign  of  trouble  rather  than 
after  trouble  has  occurred. 

Real-time  Correlation  Replaces 
Expensive  Conference  Calls 
Take  the  example  of  a  healthcare  provider 
that  routinely  had  a  dozen  IT  specialists  on 
conference  calls  for  4  to  8  hours  trying  to  find 
the  cause  of  a  recurring  problem.  It  got  so  bad 
the  CIO  joined  the  calls.  Eventually,  manually 
correlating  what  each  specialist  knew 


about  their  silos  would  hit  on  the  cause. 

Integrity  Management  takes  the  events 
that  would  ordinarily  come  in  to  each  IT 
specialist’s  tool  and  correlates  them  in  the 
context  of  the  application  experiencing  diffi¬ 
culty.  The  metrics  that  are  out  of  normal 
and  slowing  down  the  application  jump  to 


the  fore  and  the  expert  who  owns  the  issue 
is  alerted  immediately.  Integrity 
Management  can  even  correlate  a  set  of 
alerts  that  precede  a  problem.  While  moni¬ 
toring  tools  would  pass  them  on  as  a  baffling 
alert  storm,  Integrity  Management  sees 
them  as  a  play  developing  and  helps  you  go 
in  and  make  the  tackle  with  a  crisp  problem 
recognition  and  resolution  alert. 

Seeing  Into  the  Redundant  Hardware 
Black  Hole 

One  issue  with  virtualization  is  that  interde¬ 
pendencies  are  hidden  behind  the  virtualiza¬ 
tion  layer.  Although  you  address  component 
failure  with  redundant  hardware,  interdepen¬ 
dencies  actually  increase  as  you  “simplify” 
architecture  with  virtualization.  To  avoid  this 
black  hole,  you  need  Integrity  Management’s 
holistic  view  and  correlation  of  issues. 

When  a  Change  is  Managed  But  Causes 
Trouble  Anyway 

The  best  change  management  system  in  the 
world  can’t  prevent  the  occasional  disrup¬ 
tive  change  from  taking  place.  A  CMDB 
facilitates  rolling  them  back  when  they 
prove  detrimental.  But  the  issue  of  detect¬ 
ing  abnormal  behavior  introduced  by  a 
change  remains,  and  that’s  where 
Integrity  Management  comes  in. 

Business  Service  Management 
in  Real  Time 

Business  Service  Management  tools  diagram 
the  IT  infrastructure  components  that  pro¬ 


vide  business  services  and  report  on  both 
potential  business  impacts  and  historic  serv¬ 
ice  levels.  BSM  is  thus  useful  for  planning 
and  post  mortem  assessments.  In  contrast, 
Integrity  Management  focuses  on  prevent¬ 
ing  rather  than  reporting  on  trouble.  Like 
BSM,  Integrity  Management  depends  on  the 
Service  Map,  but  applies 
analysis  to  it  in  real  time 
to  minimize  the  business 
impact  when  a  service 
leaves  normal  operation. 
Trouble  Ticket  Systems 
Need  “This  Trouble  is 
Yours”  Assistance 
Assigning  troubleshooting 
responsibility  in  distrib¬ 
uted  IT  infrastructure  is 
most  effective  when  an 
Integrity  Management 
system  identifies  the 
source  of  an  issue  and 
gives  the  right  expert  the  responsibility  (plus 
information  needed  to  resolve  it). 

Integrien  Alive™  Delivers 
Higher  Availability  Through 
Integrity  Management 

Alive  Integrity  Manager  provides  a  unifying 
view  into  the  operational  “health”  of  business- 
critical  services  that  cross  multiple  domains  in 
your  IT  infrastructure.  Alive  maps  a  view  of 
the  most  critical  devices  and  metrics  into  a 
system  of  intuitive  dashboards  for  trou¬ 
bleshooting  problems  in  key  services. 
Integrien  Alive’s  Integrity  Management 
Tightens  Troubleshooting  Defenses 
As  seen  in  the  figure,  Integrien  Alive  tightly 
integrates  the  functions  necessary  to  achieve 
true  integrity  in  business  services:  dynamic 
thresholding  (the  basis  for  flagging  abnor¬ 
mal  behavior  early);  event  correlation 
(based  on  statistics;  no  rule  writing 
required);  and  an  Integrity  Alerts™  engine 
that  narrowcasts  the  information  needed  to 
resolve  a  problem  to  the  right  expert. 

Alive  learns  what’s  normal  and  “who 
owns  what”  in  order  to  detect  abnormali¬ 
ties  and  assign  responsibility  for  correct¬ 
ing  them.  • 

For  more  information  about  how  far  beyond 
simple  ROI  Integrien  Alive  can  take  you 
by  augmenting  your  existing  approaches  to 
availability  and  service  levels,  visit 
http://www.integrien.com 
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Integrien  Alive  delivers  Integrity  Management. 


ible  computers  can  work  in  the  same  Office  document  without 
going  through  a  server  or  other  host.  This  ad  hoc  networking, 
where  one  of  the  devices  essentially  acts  as  the  server,  has  broad 
implications  for  computer  gaming,  sensors  and  RFID. 

WILL  THE  BET  PAY  OFF? 

Some  Internet  experts,  such  as  Paul  Francis,  a 
computer  science  professor  at  Cornell  Univer¬ 
sity  who  also  happened  to  invent  NAT  devices, 
say  that  upgrading  networks  to  IPv6  will  cost 
so  much  and  take  so  long  that  engineers  will 
develop  workarounds— be  it  improvements 
to  NAT  devices  or  something  new— that  solve 
the  problems  with  IPv4,  keeping  the  current  Internet  in  place  for¬ 
ever.  But  most  people  familiar  with  IPv6  say  that  the  protocol  has 
too  much  promise  and  can  save  CIOs  too  much  money  for  it  not 
to  be  adopted.  Plus,  most  equipment  makers  are  already  selling 
IPv6-capable  equipment  today,  meaning  you  could  be  building  a 
next-generation  network  without  even  knowing  it  (see  “Your  Hid¬ 
den  IPv6  Network”  on  Page  45).  “In  the  next  10  years  everyone  will 
[begin]  moving  to  IPv6,”  says  Robert  Atkinson,  president  of  the 
Information  Technology  and  Innovation  Foundation,  a  technology 
policy  think  tank.  “That  is  not  in  doubt.”  The  question,  he  says,  is 
how  long  it  will  take  for  the  United  States  to  reach  critical  mass  on 
the  new  protocol. 

The  federal  government  is  moving  now,  thanks  to  an  Office 
of  Management  and  Budget  mandate  that  says  agency  networks 
must  be  IPv6-capable  by  2008.  But  a  June  2005  GAO  study 
found  that  only  one  agency,  the  Department  of  Defense,  even 
has  a  transition  plan  in  place  (an  updated  report  due  out  this 
summer  is  expected  to  show  more  agencies  making 
plans,  however). 

The  major  U.S.  telecommunications  companies, 
meanwhile,  are  taking  a  wait-and-see  approach  to 
IPv6,  says  Prodip  Sen,  director  of  data  and  service 
architecture  at  Verizon  Laboratories.  They  are 
buying  equipment  that  can  handle  both  IPv4  and 
IPv6  traffic,  and  waiting  for  demand  for  the  new 
standard  to  emerge.  The  result  is  a  chicken-and- 
egg  dilemma:  No  one  wants  to  invest  in  the  infrastructure  until 
there  are  applications  that  require  it,  but  few  companies  will 
develop  those  applications  until  there  is  a  network  that  can  run 
them. 

The  United  States’  reluctance  to  invest  in  IPv6  makes  it  more 
likely  that  China  will  be  in  a  position  to  gain  the  first-mover 
advantage  it  seeks.  A  draft  version  of  a  January  2006  report  by 
the  Department  of  Commerce  on  IPv6  contained  a  section  on 
competitiveness  that  highlighted  several  threats  to  U.S.  Internet 
leadership,  including  a  further  shift  of  high-tech  R&D  and  prod¬ 
uct  innovation  eastward  and  less  available  investment  capital 
because  of  the  higher  costs  of  maintaining  IPv4  networks.  What 
remains  to  be  seen  is  whether  China  can  develop  the  services 
that  take  advantage  of  the  next-generation  Internet.  But  China’s 


researchers  are  already  working  on  it.  At  the  IPv6  Global  Sum¬ 
mit  in  April,  China’s  major  telecommunications  and  Internet 
companies  got  up  on  stage  one  by  one  and  told  the  audience 
that  they  have  research  facilities  dedicated  to  developing  these 
services.  “CNGI  will  continue  to  be  the  most  important  topic  of 
research  for  us,”  says  Zhao  Huiling,  vice  president  of  the  Beijing 
Research  Institute  of  China  Telecom.  Similarly,  the  Chinese  gov¬ 
ernment  decided  that  CNGI’s  first  users  should  be  universities, 
research  labs  and  leading  companies  precisely  because  that  is 
where  it  imagines  innovation  will  come  from.  Liu  Dong,  presi¬ 
dent  of  the  Beijing  Internet  Institute  sums  it  up  succinctly:  “We 
think  we  can  develop  the  killer  applications,”  he  says. 

THE  2008  OLYMPICS: 

IPv6  ON  DISPLAY 

China  plans  to  show  the  rest  of  the  world  just 
how  advanced  its  Internet  is  at  the  2008 
Olympics  in  Beijing.  CNGI  will  control  the 
facilities— everything  from  security  cameras  to 
the  lighting  and  thermostats— at  the  Olympic 
venues,  and  events  will  be  broadcast  live  over 
the  Internet.  Even  the  taxis  in  Beijing’s  snarled 
traffic  will  connect  to  CNGI  via  IPv6  sensors  so  that  dispatchers 
will  be  able  to  direct  their  drivers  away  from  congestion. 

If  the  United  States  hopes  to  maintain  its  Internet  dominance, 
it  must  act.  But  there  are  few  voices  spreading  the  alarm.  The 
Department  of  Commerce  removed  the  section  on  the  competitive 
threat  of  IPv6  from  its  final  report,  because  the  government  did 
not  want  to  be  seen  as  pushing  private-sector  technology  projects, 
according  to  former  assistant  secretary  of  commerce  Gallagher. 


But  he  says  the  government  is  “acutely  aware”  of  the  threat.  How¬ 
ever,  Chairman  Davis,  who  has  asked  the  president  to  appoint  an 
IPv6  transition  czar  and  is  consistently  one  of  Congress’s  most 
outspoken  advocates  on  technology  issues,  doesn’t  mind  offering 
private-sector  CIOs  advice  of  the  most  urgent  kind. 

“We  need  to  begin  planning  now,”  he  says.  BQ 


Senior  Writer  Ben  Worthen  can  be  reached  at  bworthen@cio.com. 


China's  Internet  Leap 


Senior  Writer  Ben  Worthen  went  to  China  earlier  this  year  to  research  THE  NEXT 
GENERATION  INTERNET.  Read  his  travel  diary  at  blogs.cio.com/china-diary . 

cio.com 


★  IPv6’s  innovation  potential 
is  enormous.  Any  cell  phone, 
refrigerator  or  tnermostat 
can  be  online  anytime. 
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Bonhams  IT  Director 

Roland  Whitehead  says 
his  Linux  servers  are  so 
reliable  that  he  needs 
only  two  systems  analysts 
to  support  them. 
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SOLD! 

On  Open  Source 

Buildinganopen  source-based 
infrastructure  has  helped 
mid-market  Bonhams 
compete  with  the  auction 
industry  superpowers 

BY  MERIDITH  LEVINSON 


Shortly  after  10  a.m.  on  an  April  Sunday, 

eager  auction-goers  began  bidding  on  more  than  1,100  items— paint¬ 
ings,  furniture,  decorative  pieces  and  vintage  couture— that  London- 
based  auction  house  Bonhams  had  put  up  for  sale  in  its  Los  Angeles 
showroom.  An  image  of  a  Jules  Lefranc  oil  painting  depicting  Parisian 
rooftops  with  the  dome  of  Sacre  Coeur  cathedral  in  the  background 
was  projected  on  two  Sony  flat-screen  TVs  at  the  front  of  the  room. 
“Let’s  open  the  bidding  for  this  item  at  $350,”  announced  the  auc¬ 
tioneer,  a  rosy-cheeked  woman  with  frosted  blond  hair.  Immediately, 
a  prospective  buyer  discreetly  raised  her  paddle  to  bid  on  the  paint¬ 
ing,  valued  between  $800  and 
$1,200.  “Three-fifty  in  the  back,” 
the  auctioneer  called.  “Let’s  go  to 
four.”  Another  bidder  raised  his 
paddle.  “Four  hundred  in  the 
center  of  the  room.  Go  $450,”  the 
auctioneer  called. 

The  bidding  continued  fast 
and  furiously  in  $50  incre¬ 
ments  until  the  auctioneer  hit 


Reader  ROI 

::  Why  Bonhams  chose  to  build 
an  in-house  system  instead  of 
licensing  enterprise  software 

::  How  IT  gave  the  auction 
house  new  leverage  in  the 
marketplace 

::  How  agility  translates  to 
customer  satisfaction 
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$1,000,  whereupon  she  began  increasing 
the  bids  by  $100.  “Do  I  have  $1,200?”  the 
auctioneer  asked.  A  man  seated  toward  the 
back  of  the  room  waved  his  paddle.  “Twelve 
hundred  in  the  back  of  the  room.  Go  to  13.” 
An  art  collector  representing  a  buyer  on  the 
phone  raised  his  paddle  on  behalf  of  his  bid¬ 
der.  “Thirteen  on  the  phone.  Go  14,”  said  the 
auctioneer.  The  buyer  who  bid  $1,200  raised 
his  paddle  to  bid  $1,400.  “Fourteen  hundred 
is  bid  in  the  room.  Go  15,”  the  auctioneer 


number-two  powerhouses  respectively 
in  the  $6  billion  art  and  antiques  auction 
industry.  The  privately  held  Bonhams, 
which  conducted  over  $400  million  in 
auction  sales  in  2005,  hopes  to  increase 
its  small  fraction  of  the  market  (currently 
6  percent)  by  establishing  itself  as  a  mid¬ 
tier  player  and  broadening  its  audience 
beyond  the  blue  bloods  who  traditionally 
patronize  auctions.  Think  of  Bonhams  as 
the  Nordstrom  of  auction  houses:  It’s  high- 


says  he  built  this  core  system  internally 
rather  than  install  ERP  and  CRM  applica¬ 
tions  in  order  to  keep  Bonhams’  costs  down. 
The  trading  system,  he  says,  has  supported 
Bonhams’  growth  from  200  employees 
and  200  annual  auctions  in  2000  to  800 
employees  and  more  than  700  auctions  a 
year  today  without  occupying  the  company 
with  an  expensive,  time-consuming  soft¬ 
ware  implementation.  By  keeping  expenses 
low,  Whitehead  says,  Bonhams  can  sell  its 


“We  have  kept  our  processing  costs  so  low  that  we 

are  able  to  sell  $10  items  and  make  money  off 

themjustaswewilloff  multimillion-dollar  items.” 

-Bonhams  IT  Director  Roland  Whitehead 


announced.  A  hush  came  over  the  gallery. 
Was  that  it?  Was  the  bidding  out  at  $1,400? 
The  auctioneer  asked,  “Any  advance  on 
$1,400?”  The  auction  representative  on  the 
phone  with  the  remote  buyer  (a  Paris-based 
fine  art  dealer)  whispered  to  his  bidder  that 
someone  in  the  room  bid  $1,400.  Did  the 
dealer  want  to  bid  $1,500?  Yes,  and  the  rep 
raised  his  paddle.  But  the  buyer  in  the  room 
still  wanted  the  painting  too,  and  bid  $1,600. 
The  buyer  on  the  phone  bid  $1,700.  “I  have 
17  on  the  phone.  Any  advance  on  $1,700?” 
the  auctioneer  asked,  her  eyes  scanning  the 
room  for  last-minute  bids.  No  movement. 
With  a  rap  of  her  gavel  on  the  podium,  the 
auctioneer  announced,  “Sold  for  $1,700  to 
bidder  number  2812,”  and  then  she  quickly 
moved  on  to  the  next  painting. 

And  just  like  that,  in  two  days,  Bon¬ 
hams  showcased  1,138  and  sold  930  lots  of 
merchandise,  which  is  nearly  80  percent 
more  than  the  average  number  of  items 
Sotheby’s  puts  on  the  block  during  one  of 
its  two-day  sales. 

The  Nordstrom  of 
Auction  Houses 

Selling  more  items  at  a  lower  cost  is  Bon¬ 
hams’  strategy  for  competing  with  Chris¬ 
tie’s  and  Sotheby’s— the  number-one  and 


end,  but  your  last  name  doesn’t  have  to  be 
Bush  or  Bowles  (as  in  Camilla  Parker,  the 
wife  of  Prince  Charles)  to  shop  there. 

Although  Bonhams  has  a  long  way  to  go 
before  it  poses  a  serious  threat  to  Christie’s 
and  Sotheby’s,  it  has  made  progress  toward 
increasing  its  business.  And  IT— specifically 
a  strategy  of  building  an  open-source  infra¬ 
structure— has  helped  support  and  fuel  that 
growth.  Bonhams’  sales  have  grown  from  a 
reported  $64  million  in  2000  to  more  than 
$400  million.  Its  customer  base  has  tripled 
to  1.3  million.  With  the  art  auction  industry 
on  fire  again  after  a  three-year  downturn, 
industry  watchers  say  Bonhams  stands  to 
gain  market  share  as  col¬ 
lectors  who  wish  to  capi¬ 
talize  on  the  surge  put 
their  pieces  up  for  sale. 

The  secret  sauce  behind 
Bonhams’  bid  to  grow 
and  flourish  is  a  home¬ 
grown  auction  manage¬ 
ment  system,  which  runs 
on  Linux  and  powers 
almost  every  aspect  of 
the  auction  house’s  busi¬ 
ness,  including  functions 
as  wide-ranging  as  prop¬ 
erty  management  and 
CRM.  Bonhams  IT  Direc¬ 
tor  Roland  Whitehead 


items  at  lower  prices  than  the  more  exclu¬ 
sive  auction  houses  do  while  maintaining  a 
reasonable  margin.  “We  have  kept  our  pro¬ 
cessing  costs  so  low  that  we  are  able  to  sell 
$10  items  and  make  money  off  of  them  just 
as  we  will  make  money  off  multimillion- 
dollar  items,”  Whitehead  says. 

Auction  Wars 

Despite  its  revenue  gains,  Bonhams  is 
still  a  distant  third  behind  Sotheby’s  and 
Christie’s  in  market  share  and  auction 
sales.  (Sotheby’s,  for  instance,  earned 
$2.75  billion  in  auction  sales  last  year.) 

Bonhams  achieved  its 
third-place  status  largely 
through  a  series  of  mergers 
and  acquisitions  that  coin¬ 
cided  with  the  economic 
downturn  in  the  United 
States.  The  art  auction  mar¬ 
ket,  which  was  scorching 
during  the  late  1990s,  took  a 
turn  for  the  worse  in  2000 
when  the  U.S.  equity  mar¬ 
kets  imploded.  Suddenly,  all 
those  Internet  tycoons  who 
were  rich  on  paper  no  lon¬ 
ger  had  the  funds  to  invest 
in  Rothkos  and  Pollacks  for 
their  postmodern  offices. 


Bonhams’ 

Stack 

Database:  Progress 
Enterprise  Database 

Development  tools: 

Progress  OpenEdge, 

MS  VisualBasic, 

Runtime  Revolution 

Deployment:  Apache 
Web  Server  and  Format¬ 
ting  Objects  Processor 
(FOP),  MS  Internet  Infor¬ 
mation  Services,  Excel 

OS:  Redhat  Linux, 

MS  Server  2000 

Hardware:  IBM  System  x 
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During  that  downturn,  Brooks,  a  small 
yet  highly  profitable  auction  house  that 
specialized  in  classic  cars  and  motorcycles, 
went  on  a  buying  binge.  Robert  Brooks,  the 
founder  and  chairman  of  the  eponymous 
auction  house,  wanted  to  give  Christie’s  and 
Sotheby’s  a  run  for  their  money  and  set  out  to 
acquire  all  the  auction  houses  in  his  path.  He 
started  in  2000  with  Bonhams,  which  the 
Bonham  family  had  been  running  since  1793. 
In  fall  2001,  Bonhams  &  Brooks  merged  with 
Phillips,  then  the  third-largest  auction  house, 
to  form  Bonhams  1793  (the  Phillips  name 
was  lost  in  the  shuffle).  In  August  2002,  Bon¬ 
hams  1793  acquired  Butterfields,  which  was 
the  largest  West  Coast-based  auction  house, 
and  now  has  salesrooms  in  San  Francisco 
and  Los  Angeles  under  the  name  Bonhams 
&  Butterfields. 

What  all  of  these  companies  that  Brooks 
acquired  had  in  common  were  financial 
troubles.  Bonhams’  auction  sales  were 
stagnant.  Phillips  had  all  but  collapsed 
under  the  weight  of  its  previous  owner, 
the  French  luxury  goods  conglomerate 
LVMH,  which  spent  hundreds  of  millions 
of  dollars  between  1999  and  2002  in  what 
was  ultimately  an  unsuccessful  attempt  to 
compete  with  Sotheby’s  and  Christie’s  at  a 
time  when  they  were  embroiled  in  a  price¬ 
fixing  scandal.  And  eBay,  Butterfields’  pre¬ 
vious  owner,  nearly  put  the  fine  art  auction 
house  out  of  business  by  driving  its  cus¬ 
tomers  to  the  Web. 

The  challenge  then,  in  addition  to  restor¬ 
ing  all  these  companies  to  profitability,  was 
to  get  them  on  one  common  trading  sys¬ 
tem.  “You  cannot  have  four  different  auc¬ 
tion  systems  with  four  different  accounting 
processes,  four  different  administration 
processes,  and  four  different  ways  of  han¬ 
dling  goods  and  keep  a  handle  on  the  busi¬ 
ness,”  says  Malcolm  Barber,  Bonhams’ 
CEO  of  U.S.  operations. 

Why  Bonhams  Built 
Its  Systems  In-House 

Bonhams’  management  team  wanted  a 
user-friendly  trading  system  that  would 
provide  accurate  sales,  stock  and  customer 
information  and  would  make  the  produc¬ 
tion  of  catalogs  easier. 


Whitehead  decided  to  build  the  sys¬ 
tem  in-house  because,  having  worked 
with  packaged  applications  like  SAP, 
which  Sotheby’s  uses,  and  Siebel,  which 
Christie’s  uses,  he  didn’t  think  they  were 
flexible  enough.  He  knew  those  pack¬ 
ages  would  require  heavy  customization, 
and  with  that  customization  would  come 
increased  maintenance  fees,  which  Bon¬ 
hams  couldn’t  afford.  Given  Whitehead’s 
training  as  a  Naval  architect  and  product 
designer  and  the  half-decade  he  spent  from 
1986  to  1992  using  computers  to  develop 
World  Cup  racing  yachts,  he  felt  he  had  the 
know-how  to  develop  a  lower-cost  system 
that  would  be  more  targeted  to  the  auction 
industry  than  shrink-wrapped  software. 

“The  cost  of  tailoring  such  [enterprise 
software]  packages  is  so  high.  If  you  have 
the  right  mind-set,  the  right  skills  and  the 
right  tools,  you  can  develop  a  solution  at  a 
fraction  of  the  price  [of  the  packaged  appli¬ 


cations]  that  is  significantly  better,  and  that 
is  what  we’ve  done,”  says  Whitehead. 

Bonhams’  IT  director  also  wanted  to 
build  a  single  system  that  encompassed  as 
many  activities  and  business  processes  in 
which  the  auction  house  engages  as  possible 
so  that  he  wouldn’t  have  to  patch  together  a 
bunch  of  disparate  systems.  So  the  system 
he  built  also  includes  functions  for  print 
production,  managing  and  valuing  the 
properties  that  Bonhams  puts  up  for  sale, 
and  customer  relationship  management. 

Whitehead,  who  has  hired  IT  staff  from 
Sotheby’s  and  Christie’s,  notes  that  his 
competitors  have  to  integrate  a  bunch  of 
systems  to  get  the  functionality  they  need 
because  one  packaged  system  doesn’t  do  it 
all.  In  fact,  Sotheby’s  expenses  grew  so  high 
by  2003  that  the  company  outsourced  the 
management  and  maintenance  of  its  main¬ 
frame  systems  and  laid  off  six  IT  workers 
as  part  of  its  cost-cutting  effort,  accord- 


How  the  Houses  Compare 

A  side-by-side  comparison  of  Bonhams,  Sotheby's  and 
Christie’s,  the  three  biggest  auction  houses  worldwide 


Bonhams 

Sotheby’s 

Christie’s 

2005  auction 
sales 

Over  $400  million 

$2.75  billion 

$3.2  billion 

Market  share 

6% 

43% 

50% 

Employees 

800 

1,443 

1,800 

Auctions  held 
each  year 

Over  700 

350-400 

Approximately 

1,000 

Salesrooms 
around  the  world 

15 

15 

16 

IT  staff 

24 

118 

Declined  to  provide 
numbers 

IT  costs 

Approximately 
$1.6  million 

$59.4  million 

Declined  to  provide 
numbers 

Core  system 

A3 

SAP 

Microsoft,  Oracle 
and  others 

Dates  back  to 

1793 

1744 

1766 

-M.L. 
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ing  to  a  report  from  Wedbush  Morgan 
Securities.  By  contrast,  Bonhams’  IT  costs 
have  dropped  from  $3.5  million  in  2001  to 
approximately  $1.6  million  today  because 
it’s  running  fewer  systems  and  using  open 
source.  Whitehead  says  his  Linux  servers 
are  so  reliable  that  he  needs  only  two  sys¬ 
tems  analysts  to  support  them. 

Whitehead’s  decision  to  build  Bon¬ 
hams’  core  trading  system  in-house  flies 
in  the  face  of  conventional  IT  wisdom. 
“The  default  best  practice  across  the  indus¬ 
try  is,  it’s  better  to  buy  than  build,”  says 


ning  A3  on  a  bunch  of  small  servers  rather 
than  one  large  server  would  prevent  it  from 
crashing  if  the  system  was  hit  with  a  barrage 
of  transactions.  But  Whitehead  discovered 
that  the  cost  of  licensing  technology  from 
Sun  for  that  kind  of  distributed  computing 
architecture  was  prohibitive.  So  instead  he 
chose  to  go  with  Linux.  And  IBM,  eager  to 
enter  the  Linux  market,  made  Whitehead 
an  offer  he  couldn’t  refuse  on  its  X  series 
servers.  Whitehead  also  uses  Apache  Web 
servers,  Tomcat,  the  open-source  version  of 
the  Java  servlet,  FOP,  an  open-source  type- 


acquired  companies’  processes  into  A3 
slowed  down  the  project.  A3  went  live  six 
months  after  originally  planned,  in  Janu¬ 
ary  2003.  Whitehead  has  said  that  A3  cost 
approximately  $800,000  to  develop. 

Agility  for 
Customer  Service 

Whitehead  says  the  way  the  system  has 
been  designed  makes  adding  new  features 
a  breeze  for  developers  because  they  don’t 
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You  cannot  have  four  different  systems  and  keep 

a  handleonthe  business.’  -Malcolm  Barber,  Bonhams’  CEO  of  U.S.  operations 


Randy  Heffner,  an  analyst  with  Forrester 
Research.  Heffner  says  most  companies 
choose  to  implement  packaged  software 
because  they  don’t  want  to  spend  time  and 
money  on  an  activity  that  isn’t  a  core  com¬ 
petency.  Bonhams  chose  to  swim  against 
that  tide. 

The  Open-Source 
Stack 

Whitehead  and  two  developers  began  build¬ 
ing  the  system,  dubbed  A3,  in  May  2001, 
well  before  Brooks’  acquisition  spree  was 
complete.  The  IT  director  first  had  to  decide 
which  database  software  would  form  the 
core  of  A3.  He  opted  for  software  and  devel¬ 
opment  tools  from  vendor  Progress  for  two 
reasons:  They  were  less  expensive  than  Ora¬ 
cle  at  the  high  end  of  the  market,  and  more 
scalable  and  reliable  than  Microsoft  at  the 
low  end.  He  also  liked  the  software  because 
it  provided  a  single  programming  language 
for  three  separate  activities— coding  the  data¬ 
base,  programming  the  business  logic  and 
writing  the  programs  that  deliver  content  to 
the  Web.  “That  means  less  [for  developers] 
to  learn,  fewer  errors  and  less  time  spent 
debugging  code,”  says  Whitehead.  White- 
head  originally  wanted  to  deploy  Progress 
on  a  distributed  computing  architecture 
using  Sun’s  Solaris  operating  system;  run¬ 


setting  system,  and  many  other  open-source 
applications. 

Whitehead  is  a  strong  proponent  of 
open  source  because,  he  says,  it’s  such  a 
reliable  operating  system.  “The  cost  ben¬ 
efits  of  deploying  on  Linux  are  dramatic,” 
Whitehead  notes,  adding  that  running 
A3  on  Linux  costs  less  than  half  of  what  it 
would  cost  to  run  it  on  Solaris. 

With  the  architecture  in  place,  White- 
head  and  his  programmers  began  develop¬ 
ing  a  framework  for  storing  and  displaying 
information  in  A3.  The  framework  estab¬ 
lishes  the  user  interface  for  A3  and  man¬ 
ages  all  the  business  rules  that  dictate  how 
A3  works.  The  application  has  program¬ 
ming  logic  for  all  manner  of  activities,  from 
authenticating  users  to  tracking  properties, 
mining  customer  information  and  produc¬ 
ing  reports  on  sales  activity.  The  applica¬ 
tion  interface  is  stored  in  a  database  so  that 
developers  can  reuse  it  quickly  and  easily 
when  working  on  enhancements  to  A3. 

Whitehead  originally  planned  to  launch 
A3  in  the  summer  of  2002,  but  the  pace 
of  acquisitions  and  the  need  to  build  the 


All  About  Open  Source 


Bonhams  eschewed  proprietary  software  and 
built  its  trading  systems  on  open  source.  And 
they  work!  Bernard  Golden  will  answer  all 
your  open-source  questions  at  blogs.cio 
.com/theopensource.  pin  pnm 


have  to  write  a  lot  of  new  code.  Forrester’s 
Heffner  agrees.  “There  are  ways  for  enter¬ 
prises  to  design  applications  that  are  flex¬ 
ible  by  doing  good  design  and  analysis 
up  front,  like  it  sounds  like  Bonhams  has 
done,”  he  says. 

The  ability  to  add  new  features  to  A3 
quickly  helps  the  company  provide  bet¬ 
ter  customer  service,  Whitehead  says.  For 
instance,  last  March  a  customer  asked  one 
of  Bonhams’  appraisers  to  provide  him 
with  a  report  detailing  the  value  of  his 
collection  in  a  different  format  than  the 
auction  house  usually  provides.  The  cus¬ 
tomer  wanted  the  pictures  of  the  items  in 
his  collection  in  a  different  order,  and  he 
wanted  more  information  in  the  report. 
The  appraiser  told  the  IT  department  what 
the  customer  wanted.  Within  an  hour,  one 
of  the  developers  produced  the  appraisal 
just  as  the  customer  requested  and  added 
the  extra  functionality  to  A3  that  would 
allow  appraisers  to  customize  the  formats 
of  other  appraisal  reports.  All  the  devel¬ 
oper  had  to  do  was  modify  an  existing 
query  and  produce  a  new  report  layout 
that  could  be  processed  into  the  required 
format.  Unlike  making  changes  to  a  pack¬ 
aged  application,  no  big  change  documents 
had  to  be  written  up,  and  no  consultants 
needed  to  be  retained. 

A3  has  also  sped  up  the  creation  of  cata¬ 
logs,  which  play  a  key  role  in  encouraging 
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people  to  attend  auctions.  Carolyn  Mani, 
who’s  in  charge  of  Bonhams  &  Butter¬ 
fields’  Sunset  Estate  auctions,  says  it  took 
only  a  week  and  a  half  to  create  the  catalog 
for  an  1,100-item  auction  that  took  place 
in  Los  Angeles  last  April.  She  says  pub¬ 
lishing  catalogs  using  the  old  DOS-based 
system  under  eBay  took  twice  as  long. 
“With  the  push  of  a  button,  A3  sends  the 
entire  [catalog]  file  in  Word  form  to  our 
desktop  publishing  system.  A3  also  pub¬ 
lishes  it  to  the  Internet  simultaneously, 
so  even  before  I  have  a  printed  catalog, 
my  sale  is  online  with  photographs  and 
descriptions,”  says  Mani. 

Bonhams  can  even  react  more  quickly 
to  changes  in  regulations.  Earlier  this  year, 
the  British  government  passed  a  new  law 
called  the  Droite  de  Suite,  which  guaran¬ 
tees  that  living  artists  earn  a  percentage 
of  the  sale  price  when  their  work  is  resold 
(say,  if  a  collector  who  purchased  it  in  a  gal¬ 
lery  decides  to  auction  it).  Within  24  hours 
of  the  law  being  enacted,  Whitehead’s  team 
wrote  functionality  into  A3  that  would 


release  proceeds  from  the  sale  of  a  work  to 
the  artist. 

Bonhams’  top  executives  seem  impressed 
by  all  this  newfound  IT  agility.  When  we  ask 
things  of  IT  that  will  help  us  drive  the  busi¬ 
ness  forward,  they  come  up  with  answers 
pretty  quickly,”  says  CEO  Barber.  And  when 
he  wants  to  know  what  goods  have  been 
consigned,  which  are  ready  for  sale  and  how 
each  department  within  the  company  is 
doing,  Barber  turns  to  A3.  “When  you’ve  got 
offices  all  over  the  world,  it  gives  me  a  com¬ 
forting  feeling  that  I  can  get  an  overview  [of 
the  entire  business]  very  quickly,”  he  adds. 

Auction  Fever 

At  the  Los  Angeles  estate  sale  in  April, 
Bonhams’  “sell  more  for  less”  strategy  was 
very  much  on  display.  While  heated  bid¬ 
ding  drove  up  the  prices  on  some  items, 
including  a  sterling  silver  flatware  set  that 
was  valued  between  $2,500  and  $3,000 
but  sold  for  $6,500,  plenty  of  items  went 
for  a  song,  including  a  Federal  cherry  bed¬ 


side  table  appraised  for  as  much  as  $600, 
which  sold  for  $80.  Ellen  Sinaiko,  who 
attended  the  estate  sale  with  her  miniature 
Dachshund,  Ernie,  says  it  was  one  of  the 
best  auctions  she’s  ever  attended  because 
it  was  affordable  and  because  the  customer 
service  was  so  good.  She  says  she  spent 
about  $900  on  furniture,  costume  jewelry 
and  a  collection  of  tobacco  jars. 

“Truthfully,  I  was  bidding  because  it 
was  so  cheap.  It  was  such  a  bargain,”  she 
says.  “Where  else  could  I  get  four  Pennsyl¬ 
vania  Dutch  dining  room  chairs  for  $80?” 

Sinaiko  adds  that  she’s  attended  Sothe¬ 
by’s  and  Christie’s  auctions,  but  prefers 
Bonhams’  events  because  they’re  more 
hospitable.  “The  people  who  work  there 
are  so  friendly.  They  really  make  you  feel 
like  you’re  welcome  in  their  house.  You 
don’t  get  that  feeling  at  most  auctions  like 
Sotheby’s  and  Christie’s,”  she  says.  “They 
really  have  a  big  attitude.”  BQ 


Senior  Writer  Meridith  Levinson  can  be  reached 
at  mlevinson@cio.com. 
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IT  supports  and  controls  the 
applications  that  run  the  business. 

Now  there's  an  application  to  support 
and  control  the  business  of  IT. 

Maximo®  ITSM,  the  most  comprehensive  IT  asset  and  service 
management  solution,  substantially  improves  the  business 
of  IT,  significantly  increasing  the  value  IT  brings  to  an  organiza¬ 
tion.  By  unifying  IT  service,  asset  and  work  management  on 
a  single  software  platform,  Maximo  ITSM  delivers  the  control 
and  visibility  you  need  to  align  IT  service  levels  with  your 
overall  business  goals.  All  you  need  to  integrate  and  automate 
processes,  reduce  unplanned  outages,  standardize  and  share 
information  and  surpass  service-level  commitments.  To  make  your 
IT  organization  more  efficient  and  more  valuable,  download 
our  whitepaper  at  www.maximoit.com/cio  or  call  800-326-5765. 
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on  2.700.000  Customers 


jm. 


Join  us  for  two  days  this  September 
to  ensure  your  company  stays  off 
the  front  page. 


navi 


Here’s  just  a  small  sample  of  the 
speakers  you’ll  meet: 


Introducing  The  Security  Standard 


The  premier  enterprise  security  summit  designed  to  address 
the  converging  business  and  technology  challenges  facing  CIOs, 
CSOs  and  IT  Leaders. 

Brought  to  you  by  IDG,  the  publisher  of  C/O,  Computerworld, 
CSO,  InfoWorld  and  Network  World,  The  Security  Standard  is 
the  first  and  only  forum  to  bring  together  the  visionaries  and  the 
views  to  help  you  leverage  security  as  a  competitive  advantage. 
You’ll  listen  to  key  stakeholders  from  within  and  outside  the 
organization  as  they  debate  the  most  pressing  cultural, 
political,  business  and  technical  challenges  facing  security 
professionals  today. 
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You’ll  take  a  holistic  look  at  information 
security,  privacy  and  adaptive  risk  management 
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including  how  to: 


Identify  Effective  Risk  Management  Strategies 
Choose  the  Right  Technology  Strategies 
Understand  How  Security  Influences  the  Business 
Explore  Perceptions  Beyond  the  Organization 
Evaluate  the  New  Threat  Landscape 


Register  before  July  28th,  and  you’ll  save  $400  off 
the  regular  rate  of  $1,295. 

Visit  www.thesecuritystandard.net/CIOA2  or  call 
1-800-643-4668. 
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Keynote  Speaker 
John  Chambers,  President  and  CEO 
Cisco  Systems 

Welcome  Address 

Patrick  J.  McGovern,  Founder  and  Chairman 
International  Data  Group 


Edward  G.  Amoroso,  CSO,  AT&T 

Scott  Blake,  CISO,  Liberty  Mutual  Insurance  Group 

Mary  Ann  Davidson,  Chief  Security  Officer, 

Oracle  Corporation 

Nenette  L.  Day,  Special  Agent/Information  Systems 
Security  Officer,  FBI 

John  D.  Halamka,  CIO,  CareGroup  Health  System 
Lloyd  Gauntlett  Hession,  Chief  Security  Officer, 

BT  Radianz,  Inc. 

Mark  Moroses,  Senior  Director,  Technical  Services 
&  Security  Officer,  Maimonides  Medical  Center 
Douglas  Smith,  Senior  Vice  President  and  Corporate 
Information  Security  and  Business  Continuity 
Executive,  Bank  of  America 
John  N.  Stewart,  Vice  President  &  Chief  Security 
Officer,  Corporate  Security  Programs  Organization, 
Cisco  Systems 

Jay  White,  Global  Information  Protection  Architect, 
Chevron 

...  and  many  more  top  security  specialists  and 
business  experts. 
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View  from  the  Top 


The  CEO  of  Manpower  explains  why  a 
worldwide  IT  organization  has  to  balance 
global  efficiency  with  local  needs 


BY  CHRISTOPHER  KOCH 


When  a  company's  home  mar 
ket  is  no  longer  its  largest,  “global” 
becomes  more  than  an  ambitious 
buzzword— it  becomes  a  mat¬ 
ter  of  survival.  Manpower,  the 
employment  services  company 
that  began  in  1948  in  Milwau¬ 
kee,  now  gets  80  percent  of 
its  revenue  from  outside  the 
United  States  and  has  4,400 

offices  in  72  countries. 

IT  plays  a  critical  role  in  link¬ 
ing  those  offices  together,  helping 
drive  efficiencies  and  best  practices 
across  them.  But  it’s  a  challenge  to 
bring  those  offices  together  with¬ 
out  crushing  their  independence 
and  responsiveness  in  the  local 
markets. 

Jeff  Joerres  knows  all  about  this  challenge. 
When  he  became  chairman  and  CEO  of  Man¬ 
power  in  1999,  the  company  had  just  bailed  on 
a  $92  million  front-office  computer  system  for  its 
worldwide  offices  that  had  been  plagued  with  huge 
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8th  Annual 


cioioo 

SYMPOSIUM  &  AWARDS  CEREMONY 

DELIVERING  INNOVATION  TO  THE  ENTERPRISE 


CIO  100  Symposium  is  the  premier  place  for  CIOs  to  exchange 
ideas  with  their  peers  across  all  industry  segments  as  noted 
thought  mavens  and  recognized  leaders  in  the  CIO  community 
explore  how  to  develop,  implement  and  capitalize  on 
innovation  most  effectively. 


To  register  or  for  more  information 

call  800.355.0246  or  visit 
www.cio.com/conferences 


SESSION  HIGHLIGHTS 

Where’s  the  Next  Wave  of 
IT  Innovation  Coming  From? 

If  innovation  is  the  key  to  the  future, 
where  are  our  next  innovators  going 
to  come  from  and  how  will  that  affect 
businesses  here  and  around  the  world? 

Tapping  Internal  Creativity 

Approaches  to  innovation  can  be  as 
varied  as  the  initiatives  it  produces. 
Foster  creative  thinking  and  your 
employees  will  provide  original  ideas 
and  pioneer  new  products.  Hear  from 
CIO  100  winners  who  discovered  and 
developed  their  internal  innovation 
sources. 

U  SOA— Are  You  Ready? 

a 


Why  Not  “Not  Invented  Here”? 

Innovation  labs,  design  firms  and 
consultants  are  playing  an  increasingly 
large  role  in  the  pursuit  of  innovative 
ideas.  For  many  companies  the  once 
firmly  held  belief  that  innovation  had  to 
be  homegrown  is  falling  by  the  wayside. 
Learn  how  this  company  is  maximizing 
their  outsourcing  partnerships,  real¬ 
izing  a  new  way  of  doing  business  and 
generating  innovation  from  outside  the 
company. 

Oh,  And  One  More  Thing . 
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Service-oriented  architecture  (SOA) 
allows  IT  to  respond  quickly  to  new 
business  needs  to  deliver  applica¬ 
tions  in  real  time,  or  on  demand. 
Discuss  the  latest  developments 
and  implementation  strategies 
with  this  leader  in  the  field. 


What  is  it?  What  is  the  one  thing  more 
you  need  to  know,  learn  and  take  away 
from  this  experience?  Here  from  an 
innovation  guru  on  just  what  that  one 
more  thing  might  be. 

WHO  SHOULD  ATTEND 

Leaders  in  the  CIO  community, 
who  want  to  explore  how  to 
develop,  implement  and  capitalize 
on  innovation. 

In  other  words,  you. 


14th  annual 

CIO  100  Awards  Ceremony 


INNOVATION  TAKES  CENTER  STAGE 

Celebrate  lOO  winners  with  lOO  innovative 
technology  solutions  that  revolutionized 
lOO  world  class  organizations. 


Register  Now. 

www.cio.com/conferences 


CIO  100  Symposium  &  Awards  Welcome  to  the  Conversation. 
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cost  overruns  and  delays— causing  the  company 
to  take  a  $57  million  after-tax  write-off  in  1998. 

"We  had  kind  of  broken  the  golden  rule  that  if 
you  couldn’t  get  it  done  in  a  certain  time  frame 
you  shouldn’t  do  it,”  recalls  Joerres.  “The  proj¬ 
ect  had  become  too  all-encompassing.” 

Since  then,  Joerres’  strategy  has  been  to 
make  global  IT  investments  cautiously,  trying 
to  maintain  a  delicate  balance  between  global 
efficiencies  and  local  flexibility.  It’s  been  diffi¬ 
cult.  For  example,  offices  in  some  countries  still 
use  paper  forms  in  triplicate  for  some  aspects  of 
the  candidate  application  process— one  copy 
for  the  client,  one  for  the  local  branch  and  one 
for  corporate. 

The  paper  trail  is  one  of  the  things  that 
Manpower’s  CIO,  Rick  Davidson,  is  trying  to  eliminate  in 
the  new  incarnation  of  Manpower’s  global  IT  system  to 
make  the  candidate  application  process  entirely  electronic 
worldwide.  This  time,  the  focus  is  on  speeding  routine  pro¬ 
cesses  while  supporting,  rather  than  dictating,  processes  like 
sales  and  marketing,  where  the  locals  have  a  chance  to  shine, 
says  Joerres. 

To  manage  that  delicate  balance  of  global  and  local, 
Joerres  involves  Davidson,  who  reports  directly  to  Joerres, 


in  the  strategic  decisions  of  Manpower  in  a  unique  way:  He 
has  Davidson  develop  the  agenda  and  facilitate  the  monthly 
executive  staff  meeting.  “It  was  my  way  of  forcing  him  to  be 
right  in  the  middle  of  the  action,  to  ferret  out  what’s  impor¬ 
tant,”  says  Joerres. 

CIO  spoke  to  Joerres  about  his  expectations  for  IT  in  a 
diverse  global  company. 

CIO:  You  do  business  in  72  countries.  From  a  business 
perspective,  what  characteristics  should  a  global  IT  infra¬ 
structure  have? 

Jeff  Joerres:  In  an  organization  as  large  as  ours,  if  you  do 
everything  globally,  you  average  to  the  lowest  common 
denominator.  And  you  never  have  an  application  that’s  very 
good.  That’s  why  we  said,  it’s  not  about  all  global  or  all  local. 
It’s  the  combination. 


Globally,  we  want  to  use  IT  for  three 
things.  The  first  is,  How  can  global  IT  pur¬ 
sue  revenue  and  profit?  In  our  business,  we 
interview  10  million  people  a  year  and  put 
4  million  people  to  work.  What  if  we  could 
interview  people  faster  and  better? 

The  second  global  initiative  we  have  is 
driving  efficiency.  We  use  paper  time  slips 
in  many  countries.  What  if  I  did  that  all  elec¬ 
tronically?  I  increase  my  speed,  I  decrease 
my  error  and  I  drive  efficiency. 

And  then  the  third  thing  is  that  I  want 
global  IT  to  be  the  centerpiece  for  behav¬ 
ioral  changes  within  the  company  overall. 
By  that  I  mean,  as  an  organization  we  have  to 
modify  our  behavior  to  know  what  is  global 
and  what  is  local— to  accept  global  [processes]  because  [they 
have]  breadth  and  speed  and  efficiency.  So,  we’re  putting  IT 
out  in  front  of  business  change  because  we  believe  that  IT  is 
less  emotional  than  many  other  areas,  such  as  marketing. 

What  do  you  mean  when  you  say  emotional? 

Why  should  we  have  72  data  centers?  Doesn’t  make  any 
sense.  Now,  does  that  have  some  emotion  in  it?  Yes.  The 
emotion  is,  “If  I  don’t  have  my  data  center  then  I  don’t  have 
control  over  IT.”  Now  we  have  three  data  centers: 
Singapore,  outside  of  London  and  in  the  Mid¬ 
west  of  the  United  States.  While  [eliminating  the 
other  data  centers  was]  emotional,  it  has  so  much 
logic  behind  it,  it’s  pretty  hard  to  fight.  And  that’s 
where  you  get  the  changing  of  behavior  [to  pro¬ 
mote  global  sharing]. 

You  have  to  do  it  right  and  not  try  to  consoli¬ 
date  at  the  snap  of  a  finger,  because  you  run  the 
risk  of  actually  having  the  behavioral  changes 
backfire  on  you.  [The  new  centers  go  down]  and 
then  the  local  offices  say,  See,  that’s  why  we  don’t 
do  global.  My  data  center’s  been  down  for  a  week. 
If  it  was  mine  I’d  have  it  fixed.  So,  what  we’ve  done  is  to  make 
our  time  lines  and  budgets  as  realistic  as  possible  to  build  up 
credibility  for  the  IT  group. 

So  we  have  made,  if  you  will,  the  proverbial  turn  in  global 
IT.  From  having  nothing  [shared  globally]  four  years  ago,  to 
now  having  the  business  field  organization  saying,  Why  can’t 
we  do  more?  And  that’s  part  of  this  behavioral  change  we’ve 
been  looking  for.  Once  the  local  offices  understand  that  we 
at  corporate  are  not  trying  to  take  power  from  them,  but  [are 
trying]  to  make  their  jobs  more  market-responsive,  then  they 
really  start  to  get  the  global  aspect  of  IT  and  support  starts  to 
build  for  [more  global  IT  and  processes]. 

What  do  you  think  you’ve  achieved  from  globalization  in  IT? 

Well,  the  easiest  thing,  and  the  most  seductive  thing,  is  that 
it  drives  a  tremendous  amount  of  efficiency.  [But]  if  I  only 


Manpower 

Headquarters 

Milwaukee 
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2005  revenue 

$16  billion 

Employees  27,000 
CIO  Rick  Davidson 
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“Doing  everything  globally 
means  averaging  to  the 
lowest  common  denominator. 

We  said,  it's  not  all  global  or 
all  local.  It’s  the  combination.” 

-Jeff  Joerres,  CEO  of  Manpower 
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1^  CIO  Leader 

Updates,  insights  and  advice  from 
CIO.com  on  hiring,  firing  and  inspiring. 


1 ^  CIO  Magazine  Tech  Poll 

Results  of  our  quarterly  survey,  covering  IT’s 
overall  health  as  well  as  spending  and  trends. 

^  CIO  News  Watch 

The  week’s  top  news  stories. 

^  CIO  Open  Source 

A  monthly  peek  at  what’s  happening  in  the 
open  source  realm. 

1 ^  CIO  Research  Update 

Highlights  of  CIO’s  most  recent  IT  research. 

CIO  SO  A 

Your  resource  for  service-oriented  and 
enterprise  architecture. 

^  CIO  Whitepapers 

Your  guide  to  new  and  upcoming  whitepapers. 

^  CIO  Wireless 

Providing  information  on  emerging  wireless 
technologies  and  infrastructure. 


Sign  up  now  for  CIO’s  COMPLIMENTARY  e-mail  newsletters 

www.cio.com/newsletters 


Business  Technology  Leadership 


View  from  the  Top 


“If  youonlyincentIT  on  efficiency, 
then  you  will  drive  out  the 
ability  for  IT  to  look  at  things 
from  a  growth  perspective. 

They  would  only  be  looking 
from  a  cost  perspective. 
And  I  think  that’s  dangerous.” 


-Jeff  Joerres,  CEO  of  Manpower 


incent  IT  on  efficiency,  then  everything  is  going  to  be  driven 
toward  centralization,  and,  in  my  opinion,  marginalized.  You 
will  drive  out  the  ability  for  IT  to  look  at  things  from  a  growth 
perspective.  They  would  only  be  looking  at  it  from  a  cost  per¬ 
spective.  And  I  think  that’s  dangerous. 

Another  thing  that  we  have  really  worked  on  is,  How  do 
you  not  get  IT  trapped  so  that  they  own  all  of  the  cost-benefit 
analysis?  The  way  we  used  to  do  it  was,  IT  would  request 
and  own  the  projects.  Then  IT  would  go  off  and  start  projects 
and  the  business  would  say,  “Oh,  yeah  well,  I  don’t  know  if 
I  really  wanted  that.”  And  IT  would  be  left  holding  the  bag. 
Now,  the  business  has  to  sign  up  for  them  in  the  budget-plan¬ 
ning  sessions. 

[We  also  build  business  accountability  by  having]  service- 
level  agreements  and  chargebacks.  We’re  saying  to  the  busi¬ 
ness,  “It’s  your  IT  budget.  It’s  allocated  back  to  you.”  It  is  not  a 
perfect  science.  Because  as  soon  as  you  try  to  make  it  a  perfect 
science,  a  [local  office]  will  find  a  hole  in  it  and  then  say  they’re 
being  overcharged.  So,  we’re  saying,  “You’re  missing  the  big 
picture.  The  allocation  is  there  so  that  you  don’t  think  that  the 
[IT  budget]  is  a  honey  pot.” 

The  other  issue  is  this:  Small  countries  could  never  do 
anything  with  IT  if  you  do  everything  on  an  allocation  basis. 
For  example,  if  we  put  in  a  system  and  send  three  people  to 
install  it  in  the  U.K.,  that  kind  of  effort  is  not  justified  in  the 
Philippines  because  the  office  is  so  much  smaller.  So  we  may 
[subsidize  the  small-office  effort].  The  big  country  says,  Well, 
you  charged  me  for  them.  We  say,  Sorry  guys,  that’s  the  way  a 
company  works!  We  can’t  just  let  the  smaller  offices  do  noth¬ 
ing  or  do  whatever  they  want  because  we  could  live  to  regret 
it  later  on  if  they  grow. 


The  Lowdown  on  IT  Labor 


How  did  your  experience  selling  IBM 
mainframes  shape  your  view  of  IT? 

It  showed  me  the  complexity  of  build¬ 
ing  an  application.  Seeing  that  from 
the  other  side  of  the  table  has  given  me 
insight  into  what  we  don’t  want  to  do 
with  IT  in  our  company. 


To  read  more  about  THE  LABOR  SHORTAGE 
PARADOX  discussed  by  Jeff  Joerres,  go  to 

www.cio.com/071506  to  download  a  Man¬ 
power  research  report.  For  more  of  Executive 
Editor  Christopher  Koch’s  interview  with 
Joerres,  listen  to  the  podcast  at  www.cio 
.com/podcasts. 

cio.com 


What  you  want  to  do  is  easy;  you  read  that  in 
a  book.  What  you  don’t  want  to  do  involves  the 
harder  things  that  are  behavioral  driven,  [like 
refusing  to  share  resources  and  information]. 
I’m  cynical  at  times  with  an  IT  budget.  And  the 
cynicism  doesn’t  come  from  inflated  applica¬ 
tion  costs.  The  cynicism  comes  from  how  much 
garbage  is  laying  on  the  floor  when  the  people 
in  an  organization  aren’t  being  honest  with  one 
another. 

For  example,  the  organization  decides  to  do 
a  global  application.  And  then  you  get  into  the 
local  budget  and  you  see  some  weird  IT  stuff 
in  there  and  you  find  out  that  they’re  not  bank¬ 
ing  on  the  global  IT  guy  coming  through.  So 
they’re  writing  a  new  version  of  their  own  software. 

That  drives  me  nuts.  Now,  if  you  told  me  [you  don’t  think  IT 
can  deliver],  you  might  actually  get  the  local  rewrite  approved. 
If  the  application  is  critical  to  your  business  and  global  IT  has 
not  delivered,  maybe  that’s  a  good  business  decision.  But  you 
better  say  exactly  what’s  going  on.  Otherwise  it’s  going  to  get 
cut.  Because  that’s  just  bad  behavior. 

How  do  you  root  out  that  behavior? 

You’ve  got  to  have  the  dialogue.  If  you’re  hiding  something  in 
a  budget,  you  don’t  get  fired  because  of  that.  You  get  coached: 
Why  are  you  doing  that?  What  behavior  are  we  exhibiting 
that  says  you  should  be  doing  that?  Don’t  do  that  again,  bring 
it  forward.  Or,  what  is  global  IT  doing  wrong?  Maybe  global 
IT  needs  a  kick  in  the  butt.  Now  if  it  happens  a  second  or  a 
third  time,  it’s  a  different  kind  of  discussion. 

Your  company’s  labor  market  research  has  said  that  there’s 
a  shortage  of  talent  in  IT.  And  yet,  readers  write  letters  say¬ 
ing,  I'm  out  there  looking  for  work  and  I  can’t  find  anything. 
What  kind  of  a  shortage  are  we  talking  about? 

When  I  do  media  interviews,  invariably  I  get  e-mails  and  let¬ 
ters  saying,  What  are  you  talking  about?  I  have  great  experi¬ 
ence  and  I  can’t  find  a  job. 

[But]  unfortunately,  companies  are  looking  at  talent  in  a 
very  different  way  They  are  not  geographically  bound  as 
much.  There  may  be  a  great  C+  programmer  in  Boston  but 
somebody  needs  him  in  Madison,  Wis.,  today. 

The  product  lifecycle  of  an  electronic  device  used  to  be  three 
years.  So,  everything  keyed  off  of  that  [and  labor  market  cycles 

were  longer].  The  product  lifecycle  is 
now  three  months  and  labor  has  to  key 
off  of  that  [meaning  there  is  going  to  be 
faster  turnover  in  jobs].  And  that  creates 
a  very  discomforting  situation.  And  I 
don’t  know  how  you  reverse  that.  BQ 


You  can  reach  Executive  Editor  Christopher 
Koch  at  ckoch@cio.com. 
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OffshoreOutsourcing  Guide  ^ 
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In  all  the  discussion  about  outsourcing,  one  simple  fact  sometimes  gets  lost: 

Nobody  beats  the  United  States  when  it  comes  to  people  with  IT  skills.  Taking 
into  account  the  size  and  availability  of  the  labor  force,  their  education,  relevant 
experience,  language  skills  and  turnover  rates,  AT  Kearney  ranked  America  tops 
in  this  area  on  its 2005  Global  Services  Location  Index. 

But  labor  arbitrage— cutting  costs  by  exploiting  the  availability  of  lower-wage 
workers— remains  the  name  of  the  game  in  IT  sourcing.  CIOs  continue  to  seek 
savings  through  offshore  outsourcing,  and  the  Everest  Research  Institute  pre¬ 
dicts  those  savings  will  continue  to  drive  sourcing  offshore  for  the  next  30  years. 
Today,  73  percent  of  Fortune  2000  companies  say  offshoring  is  an  important  part 
of  their  overall  growth  strategy,  according  to  the  2005  Duke  University  CIBER/ 
Archstone  Consulting  study.  And  Gartner  predicts  worldwide  offshore  spending 
will  reach  $50  billion  next  year. 

In  this,  CIO's  third  global  outsourcing  guide,  we  observe  how  the  offshoring  world 
has  changed.  (View  previous  guides  at  www.cio.com/archive/071504/guide.html.) 


Risks,  rewards,  challenges  and 
opportunities,  country  by  country 

BY  STEPHANIE  OVERBY 

The  Executive  Summary 

India  remains  the  leading  offshore  destination  by  a  wide  margin,  particularly  for 
U.S.  and  U.K.  companies.  “Every  year,  the  risks  of  moving  work  to  India  get  lower,” 
says  Dean  Davison,  VP  of  strategic  outsourcing  for  Nautilus  Advisors.  “India  is 
increasingly  more  adept  at  IP  protection,  providing  resilient  infrastructure  and 
managing  global  relationships  effectively.”  Although  Gartner  estimates  that  India 
currently  holds  80  percent  to  90  percent  of  the  offshoring  market,  wage  inflation 
and  the  increasing  maturity  of  other  low-cost  areas  threaten  its  future  dominance. 
And  as  India’s  star  has  risen,  so  have  its  turnover  rates— a  growing  concern  for  CIOs. 
Consequently,  Davison  expects  India’s  market  share  to  shrink  20  percent  by  2010. 

Today,  less  than  10  percent  of  American  companies  outsource  to  more  than  one 
country  but  “most  are  evaluating  multiple  locations,”  says  Davison.  China,  for 
example.  Experts  say  it  could  be  a  powerful  rival  to  India  in  the  next  three  to  five 
years,  even  though  it  currently  can’t  match  India’s  large  English-speaking  work¬ 
force,  its  level  of  compliance  with  international  law  or  its  number  of  IT  grads. 

Labor  and  operational  costs  in  Central  European  countries  such  as  Poland,  Hun¬ 
gary  and  the  Czech  Republic— attractive  outsourcing  options  for  Western  European 
businesses— continue  to  rise,  approaching  the  level  of  their  customers.  So  penny- 
pinching  European  CIOs  are  looking  deeper  into  the  former  Soviet  bloc,  to  countries 
like  Romania,  Bulgaria  and  the  Ukraine.  Latin  American  destinations  such  as  Costa 
Rica,  Mexico  and  Brazil  are  beginning  to  attract  U.S.  back-office  and  call  center  work 
as  the  need  to  service  Spanish-speaking  markets  grows.  And  A.T.  Kearney  suggests 
that  the  Middle  East  and  Africa  may  be  the  next  frontier  for  offshore  operations— if 
the  politics  of  the  area  stabilize. 

Although  labor  costs  will  continue  to  be  the  driving  factor  behind  offshoring, 
CIOs  must  internalize  the  “cost-versus-risk  equation,”  says  Ian  Marriott,  research 
vice  president  at  Gartner.  When  going  offshore,  common  risks  (infrastructure 
stability,  process  maturity,  security)  become  more  conspicuous,  and  uncommon 
risks  (human  resource  predictability,  political  stability,  rule  of  law  or  lack  thereof) 
emerge.  Increased  competition  for  the  offshore  outsourcing  dollar  promises  to 
raise  standards  around  the  globe,  but  more  opportunity  equals  more  risk,  and 
choosing  a  location  is  an  increasingly  complex  decision— one  we’re  hoping  the 
“2006  Global  Outsourcing  Guide”  will  help  you  make. 


Our  Ratings  ★y  ✓  $ 

Leading,  Challenging, 

Emerging  and  Nascent  labels 
are  based  on  the  maturity 
of  the  industry,  the  size  of 
the  market,  the  availability 
and  cost  of  skilled  labor, 
and  the  infrastructure 
(both  government  support 
and  actual  technology  infra¬ 
structure).  Declining  ratings 
were  given  to  countries  where 
rising  costs  threaten  the 
relevance  of  outsourcing  for 
labor  arbitrage  reasons. 

Relative  geopolitical  risk 
ratings,  which  include  political, 
financial  and  economic  risk, 
are  based  on  2006  data  from 
The  PRS  Group,  a  business 
information  provider;  low, 
medium  and  high  are  qualified 
risk  ratings  accurate  only  in 
comparison  to  other  countries 
in  this  guide,  not  globally. 

Additional  information 
was  provided  by  the  Ever¬ 
est  Research  Institute,  A.T. 
Kearney’s  2005  Global  Ser¬ 
vices  Location  Index,  Gartner. 
NeolT's  “Mapping  Offshore 
Markets  Update  2005"  and 
"Offshore  and  Nearshore  Sal¬ 
ary  Report,"  Mercer's  “2005 
Global  Pay  Trends— IT  Function 
Report,"  2005  Duke  University 
CIBER/Archstone  Consult¬ 
ing  Biannual  Offshore  Survey, 
Trestle  Group's  "Offshore 
Outsourcing  Country  Profiles," 
Datamonitor,  websites  of  vari¬ 
ous  countries'  IT  organizations 
and  individual  interviews. 
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ASIA 

India 

Leading  ★  ★★★★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  V /f 
English  proficiency:  ✓✓✓✓ 

Pros:  Working  to  stay  on  top,  challenging 
Western  IT  integrators  and  consultancies 
for  business.  Has  essential  resources  and 
robust  infrastructure  to  deliver  comprehen¬ 
sive  application,  infrastructure  and  busi¬ 
ness  process  services.  Rakes  in  almost 
$18  billion  in  IT  and  BPO  annually.  TCS,  HCL 
Technologies,  Wipro,  Satyam  and  Infosys 
have  all  topped  the  billion-dollar  mark  and 
are  moving  up  the  IT  value  chain.  Home  to 
some  of  the  most  technologically  advanced 
companies  in  the  world;  three  out  of  five  of 
the  world’s  CMM  Level  5  companies  are  in 
India.  200,000  IT  grads  per  year. 

Cons:  Turnover,  turnover,  turnover.  Even 
India’s  National  Association  of  Software  and 
Services  Companies  says  it’s  a  big  problem. 
Turnover  rates  of  10%  to  12%  in  entry-level 
positions,  15%  to  20%  in  middle  manage¬ 
ment;  you  can  lose  100%  of  a  project  team 
overnight.  Wages  also  on  the  rise.  On 
International  Intellectual  Property  Alliance 
(II  PA)  priority  watch  list. 


China 

Challenging 

Average  programmer  salary:  $  $ 
Geopolitical  risk:  ^ M 
English  proficiency:  \/ 

Pros:  Poised  to  take  over  India’s  top  spot, 
growing  at  25%  a  year  since  1999. 


Infrastructure  improving.  Shanghai  and 
Beijing  well-connected;  second-tier  cities 
catching  up.  Business  transparency  increas¬ 
ing.  Estimated  2  million  Chinese  software 
programmers  right  now  and  still  growing. 
Good  location  for  servicing  local  operations 
of  multinationals  and  Chinese  companies. 
Low-cost  alternative  for  neighboring  Japan, 
Korea,  Taiwan,  Hong  Kong  and  Singapore. 

Cons:  IT  services  companies  small  and 
inexperienced  in  global  business  and 
enterprise  IT.  Project  managers  and  senior- 
level  talent  scarce.  English  skills  minimal. 
Data  and  IP  protection  continues  to  be 
an  issue.  On  1 1  PA  priority  watch  list.  Used 
mainly  for  low-end  application  develop¬ 
ment,  maintenance,  testing.  Rising  wages 
may  dilute  attractiveness. 

Malaysia 

Challenging  ★  ★★★ 

Average  programmer  salary:  $$$ 
Geopolitical  risk:  M X 
English  proficiency:  ✓✓ 

Pros:  Ranked  third  on  A.T.  Kearney's  off¬ 
shoring  attractiveness  list.  Strong  govern¬ 
mental  support  and  continued  investment 
in  world-class  infrastructure  (Multimedia 
Super  Corridor  initiative).  Programs  and 
policies  to  expand  the  labor  pool  and 
deepen  English  language  and  technical 
skills.  Could  be  a  good  second  location  for 
minimizing  offshore  risk. 

Cons:  Lacks  critical  mass  to  be  a  top  IT 
services  location.  Low  service  maturity  and 
small  labor  pool. 


Philippines 

Challenging  'k  'k'k  'k 
Average  programmer  salary:  $$ 
Geopolitical  risk:  M X  V 
English  proficiency:  ✓✓✓✓ 

Pros:  Ranked  fourth  overall  by  A.T.  Kearney, 
due  largely  to  language  skills  (English  with 
American  accents),  Western  cultural  literacy 
and  exposure  to  global  business.  Tied  with 
Ghana  for  the  world’s  best  financial  incen¬ 
tives  for  attracting  IT  business.  Bandwidth 
high  compared  to  neighbors.  Years  of  expe¬ 
rience  with  standard  BPO  projects,  earning 
country  about  $1  billion  annually. 

Cons:  Continued  political  instability  and 
infrastructure  weaknesses.  Low  IT  pro¬ 
cess  maturity.  CMM,  Six  Sigma  and  other 
process  certifications  not  followed  until 
recently.  On  1 1  PA  priority  watch  list. 

Vietnam 

Nascent  ★★ 

Average  programmer  salary:  $ 

Geopolitical  risk:  M V 
English  proficiency:  ✓✓ 

Pros:  Cheap;  lowest  wages  in  the  outsourc¬ 
ing  world.  Major  contracts  with  Western 
telecom  providers  like  Nortel  Networks  and 
completion  of  tech  park  in  Ho  Chi  Minh  City 
promising.  English  now  standard  curricu¬ 
lum.  IT  sector  growing  20%  annually.  Low 
attrition  rates.  Could  step  in  as  a  low-end 
provider  for  basic  IT  projects  as  India  moves 
up  the  value  chain. 

Cons:  High  risk  of  IP  loss  and  infrastructure 
outages.  Entire  country  operates  on  60MB 
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of  bandwidth.  Inadequate  non-IT  infrastruc¬ 
ture  (roads,  power  grid,  airports,  real  estate 
development).  Most  companies  can  offer 
only  small-scale  back-office  functions.  Low 
number  of  English  speakers  and  senior  IT 
managers. 

Thailand 

Nascent  ★★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  M  V 
English  proficiency:  */ 

Pros:  Biggest  jumper  in  the  A.T.  Kearney 
offshore  index,  thanks  to  improvements  in 
education,  infrastructure  and  overall  busi¬ 
ness  environment.  Look  out,  Philippines— 
could  emerge  as  a  low-cost  challenger. 

Cons:  Weak  English-language  capabilities. 
On  IIPA  priority  watch  list. 

Singapore 

Declining  'A' 

Average  programmer  salary:  $$$$ 
Geopolitical  risk: 

English  proficiency:  %/  \/ 

Pros:  Positions  itself  as  stable  location  for 
sensitive,  high-end  activities,  with  emphasis 
on  business  continuity/disaster  recovery, 

IP  protection  and  data  privacy.  Ranked  fifth 
on  A.T.  Kearney's  offshoring  attractiveness 
list.  Topped  business  environment  category. 
When  Kearney  rejiggered  its  index  to  give 
risk  minimization  more  weight,  Singapore 
came  out  on  top. 

Cons:  So  expensive  that  Singapore 
outsources  to  China. 


EUROPE 


Ireland 

Declining  ^ 

Average  programmer  salary:  ^  ^  ^  ^  ^ 

Geopolitical  risk:  M 

English  proficiency:  \/  \/  \/  s/ 

Pros:  Mature  market  for  offshore  contact 
center  services.  Excellent  infrastructure. 
Obvious  cultural  compatibility.  Political 
stability  and  data  and  IP  security  big  pluses. 

Cons:  Too  expensive;  no  longer  viable  cen¬ 
ter  for  labor  arbitrage.  Gap  between  labor 
supply  and  demand  a  burgeoning  problem. 

Hungary 

Challenging  ★  ★★★ 

Average  programmer  salary:  $  $  $ 
Geopolitical  risk: 

English  proficiency:  \/ 

Pros:  EU  member  boasts  low  costs  and 
good  cultural  compatibility  with  Western 
Europe.  Establishing  itself  as  data  center 
home  for  businesses  in  nearby  European 
countries. 

Cons:  Wages  and  other  costs  on  uptick. 
Poor  English  skills  and  infrastructure. 

Romania 

Emerging  ★  ★★ 

Average  programmer  salary:  $  $ 
Geopolitical  risk:  M M 
English  proficiency :  \/  %/ 

Pros:  Attractive  destination  for  Europe— 
particularly  Italy— because  of  proximity 
and  well-developed  English  and  Western 
European  language  skills.  Romanian  IT 
professionals  consistently  place  in  top 


Overall  Ranking 

★★★★★ 

Leading 

★  ★★★ 

Challenging 

★★★ 

Emerging 

★★ 

Nascent 

★ 

Declining 

English  Proficiency 

✓✓✓✓✓ 

Excellent 

✓✓✓✓ 

Very  good 

✓✓✓ 

Good 

✓✓ 

Fair 

✓ 

Poor 

Average  Entry-Level 
Programmer  Salary  US  $ 

(2 years'  experience) 

$ 

less  than  $5K 

$$ 

$5K-$10K 

$10K-$15K 

$$$$ 

$15K-$20K 

$$$$$ 

More  than  $20K 

Relative  Geopolitical  Risk 

y 

Low 

yy 

Moderate 

yyy 

High 

rank  at  global  programming  competitions. 
Most  IT  professionals  per  capita  in  Europe, 
according  to  Brainbench.  Can  provide  multi¬ 
lingual  call  centers,  with  particular  specialty 
in  French  and  Italian. 

Cons:  Weak  IT  infrastructure  (may  improve 
as  country  attempts  to  join  EU  next  year). 
Most  companies  are  small— 15  to  20  people. 
IP  protection  a  problem,  although  piracy 
rate  has  decreased  recently. 

Bulgaria 

Emerging  ★  ★★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  V ^ 

English  proficiency:  ✓  ✓ 

Pros:  Historical  high-tech  center  of  former 
Soviet  Union.  Good  for  high-end,  complex 
but  small-scale  projects.  Renovating  Soviet- 
era  telecom  and  IT  infrastructure  preparing 
for  possible  EU  membership  in  2007.  Expe¬ 
rienced  service  providers  (as  many  as  a 
thousand  Western  companies  were  doing  IT 
work  in  Bulgaria  as  far  back  as  the  1990s). 
Excellent  math,  science  and  engineering 
schools.  IT  workers  experienced  in  complex 
technologies. 

Cons:  Small  workforce;  only  800  Bulgarians 
graduate  with  technical  degrees  each  year. 

IT  spending  ranks  one  of  the  lowest  in  the 
Central  and  Eastern  Europe.  Can’t  compete 
on  price  or  scale  with  India  or  China. 
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Czech  Republic 

Challenging  ★  ★★★ 

Average  programmer  salary:  $$$ 
Geopolitical  risk:  M  & 

English  proficiency:  ✓  ✓✓ 

Pros:  Low  costs,  political  stability  and  cul¬ 
tural  compatibility.  Emerged  as  ideal  loca¬ 
tion  for  German  customer  service  needs. 

Cons:  Salaries  and  other  costs  on  the  rise. 
Little  government  support  for  IT  services 
industry.  IT  process  maturity  low. 

Poland 

Challenging  A  'k 
Average  programmer  salary:  $$$ 
Geopolitical  risk:  M M 
English  proficiency:  ✓  ✓✓ 

Pros:  EU  member  state  a  favorite  location 
for  German  companies  (nearly  400,000 
German  speakers  here).  Offers  cultural  and 
time  zone  compatibility  for  much  of  Western 
Europe.  Good  base  of  English  speakers. 

Cons:  Lack  of  service  maturity  and  relatively 
small  labor  pool.  Wages  and  costs  rising. 

Ukraine 

Emerging  ★  ★★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  A  M 
English  proficiency : 

Pros:  IT  industry  benefited  from  2004 
political  upheaval.  IT  services  sector  grew 
50%  to  $150  million  in  2005.  Highly  edu¬ 
cated  IT  staffs  may  be  able  to  handle  entire 
development  process.  Low  turnover. 


Cons:  English  not  widespread.  Political 
stability  questionable.  Small  talent  pool. 

On  1 1  PA  priority  watch  I  ist. 

Russia 

Challenging  'h  A  'k  A 
Average  programmer  salary:  $$$ 
Geopolitical  risk:  ^ M 
English  proficiency:  %/ 

Pros:  Highly  skilled  labor  pool  offering  bou¬ 
tique  approach  to  outsourcing.  Specializes 
in  complex  modeling  and  creative  problem 
solving.  Hourly  rates  as  low  as  India. 

Cons:  Ranked  39th  out  of  40  on  business 
environment  metrics,  according  to  A.T. 
Kearney.  Costs  rising.  Poor  infrastructure 
and  security.  English  and  Western  European 
language  proficiency  lacking.  Project  man¬ 
agement  skills  low.  World’s  worst  for  piracy, 
accordingto  1 1  PA. 

MIDDLE  EAST 

Israel 

Declining  ^ 

Average  programmer  salary:  $$$$ 

Geopolitical  risk:  M M 

English  proficiency:  ✓  ✓✓✓ 

Pros:  Promotes  itself  as  ideal  location  for 
high-end  research  and  development  work. 
Multilingual  customer  support.  Strong 
education  system  and  diverse  population. 

Cons:  Politically  unstable  and  expensive. 

On  1 1  PA  priority  watch  list. 


Egypt 

Emerging  ★★★ 

Average  programmer  salary:  $ 

Geopolitical  risk:  X M M 
English  proficiency:  ✓  ✓✓✓ 

Pros:  Ranks  12th  in  A.T.  Kearney’s  attractive¬ 
ness  index  with  highly  educated  tech  work¬ 
ers,  historical  exposure  to  Western  languages 
and  low  costs.  Trying  to  be  "gateway”  from 
West  to  Middle  East.  Increasing  customer 
service  standards.  Investing  heavily  in  IT 
infrastructure.  Datamonitor  predicts  Egypt 
will  experience  most  aggressive  offshore 
outsourcing  growth  in  the  world  through  the 
next  decade. 

Cons:  Security  and  political  stability 
concerns.  On  IIPA  priority  watch  list. 


AFRICA 

Ghana 

Nascent  ★  ★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  AVy 
English  proficiency:  \/  \/  \/  %/ 

Pros:  Government  supporting  IT  services 
industry  and  investment  programs  enticed 
Allied  Computer  Services  to  establish  BPO 
operation  here.  English  is  official  language. 
Low  turnover  rate  (2%  to  4%).  Labor  cheap 
and  available.  Tied  with  Philippines  for 
world's  best  financial  incentives  for  attract¬ 
ing  IT  business,  accordingto  A.T.  Kearney. 

Cons:  Local  BPO  service  providers  lack 
experience.  IT  services  market  very  small. 
Just  10,000  IT  grads  per  year. 
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Overall  Ranking 

★★★★★  Leading 
★★★★  Challenging 
★★★  Emerging 
★★  Nascent 

★  Declining 

English  Proficiency 

✓✓✓✓✓  Excellent 
✓✓✓✓  Very  good 
✓✓✓  Good 
✓✓  Fair 
✓  Poor 

Average  Entry-Level 
Programmer  Salary  US  $ 

(2  years'  experience) 

less  than  $5K 
$5K-$10K 
$10K-$15K 
$15K-$20K 
More  than  $20K 


i 


South  Africa 

Challenging  ★  ★★★ 

Average  programmer  salary:  $$$ 

Geopolitical  risk:  A, A 

English  proficiency:  ✓  ✓✓✓ 

Pros:  Has  attracted  high-profile  clients  for 
call  center  outsourcing.  Good  English  profi¬ 
ciency.  Time  zone  compatibility  and  cultural 
affinity  with  Western  Europe. 

Cons:  High  costs  (particularly  telecom) 
and  low  process  maturity  relative  to  other 
offshore  destinations.  High  crime  rate. 


THEAMERICAS 


Canada 

Declining  A 

Average  programmer  salary:  ^  ^  ^  ^  ^ 

Geopolitical  risk:  A 

English  proficiency:  ✓  ✓✓✓✓ 


Pros:  Second  largest  outsourcing  market 
in  the  world  (after  India),  earning  nearly 
$13.7  billion  in  IT  and  BPO.  Capability  for 
complex  integration  technology  and  ser¬ 
vices.  Fifth  in  people  and  skills  availability, 
according  to  A.T.  Kearney.  Attractive  near¬ 
shoring  option  for  U.S.,  with  high-quality 
service,  low  risks.  Low  turnover.  Ideal  spot 
for  English-speaking  call  centers. 


Cons:  Shift  in  exchange  rates  undid  much 
of  previous  advantage  in  labor  arbitrage, 
property  overheads.  Some  U.S.  cities  now 
cheaper.  May  continue  to  lose  attractiveness 
as  services  offered  by  lower-cost  countries 
mature. 


Mexico 

Challenging  ★★★★ 

Average  programmer  salary:  $$$ 
Geopolitical  risk:  A  A 
English  proficiency:  %/ 

Pros:  Second  largest  IT  services  market  in 
Latin  America  and  still  growing.  Increasingly 
attractive  as  a  call  center  platform  for  serving 
Spanish-speaking  populations.  Call  center 
positions  expected  to  grow  from  33,500 
today  to  80,000  by  2010,  according  to  Data- 
monitor.  Weakness  of  peso  against  dollar 
provides  additional  savings.  IBM,  Accenture 
and  EDS  maintain  significant  presence. 

Cons:  Poor  English  skills  and  IT  process 
discipline.  Rising  costs.  Best  for  low-level 
application  development  and  maintenance 
services  requiring  minimal  interaction. 


Costa  Rica 

Emerging  ★  ★★ 

Average  programmer  salary:  $$$ 

Geopolitical  risk:  A  A 

English  proficiency:  ✓  ✓✓✓ 

Pros:  Now  exporting  more  software  than 
bananas  thanks  to  low  costs,  a  bilingual 
workforce  and  political  stability.  Becoming 
a  hub  for  call  center  and  back-office  out¬ 
sourcing.  Literacy  rate  95%. 

Cons:  Small  labor  pool.  Government-owned 
telecom  monopoly  hampers  IT  industry 
growth.  Showed  improvement  in  A.T. 
Kearney's  offshoring  attractiveness  index 
in  2005,  but  still  ranks  below  19  other  coun¬ 
tries.  Tax-free  offers  to  foreign  companies 
ruled  illegal  by  WTO  and  must  be  phased 
out  by  2009. 


Relative  Geopolitical  Risk 

M  Low 

yy  Moderate 

yyy  High 

I  MKHL  |gHH|  I 


Brazil 

Emerging  ★★★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  AAA 
English  proficiency:  |A 

Pros:  Latin  American  leader  in  IT  services 
market.  Leading-edge  infrastructure  (spends 
more  on  technology  per  GDP  than  India  or 
China).  Graduates  15,000  IT  profession¬ 
als  annually;  certification  rates  on  the  rise. 
Possible  nearshore  alternative  for  North 
American  countries  and  good  possibility  for 
Spanish  and  Portuguese  language  projects. 

Cons:  Business-unfriendly  labor  and  trade 
laws.  Poor  English.  Globally  unsophisticated. 


Argentina 

Nascent  ★  ★ 

Average  programmer  salary:  $$ 
Geopolitical  risk:  A  A 
English  proficiency:  ✓  ✓ 

Pros:  Skilled  workforce  and  good  IT  and 
telecom  infrastructure.  Favorable  time 
zone  for  North  American  work.  Leader  in 
Spanish-content  software  products.  Low 
costs  a  result  of  peso  devaluation  in  2002. 

Cons:  IT  sector  small.  Ranked  23rd  in 
offshore  attractiveness  by  A.T.  Kearney. 
Government  not  investing  in  IT  services 
sector.  Process  maturity  low.  QQ 


Senior  Editor  Stephanie  Overby  can  be  reached 


at  soverby@cio.com. 


www.cio.com  |  JULY  15,  2006  69 


CIO  SALES  OFFICES 

President  and  CEO 

Michael  Friedenberg 
508  935-4310 
Publisher 
Gary  J.  Beach 
508  935-4202 

EAST  COAST 

VP  Sales,  East 

Bob  Bragdon 
508  935-4443 
Regional  Sales  Manager 
Ellie  St.  Louis 
201634-2332 
Senior  Sales  Associate 
Norma  Tamburrino 
201 634-2329 
Fax -201 634-9513 

NEW  ENGLAND 

Senior  District  Sales  Manager 

Andrew  Haney 
508  935-4586 

Sales  Operations  Manager 

Dawn  Cora 
508935-4092 
Fax  *508  879-6063 

NORTH  CENTRAL 

Regional  Sales  Manager, 
Southwest 

Beth  DeVillez 
847  759-2727 

Advertising  Sales  Associate 

Kim  Giovanni 
847  759-2728 
Fax  •  847  759-2729 


WEST  COAST 

VP  Sales,  West 

Bob  Melk  •  415  975-2685 

Senior  Regional  Sales  Manager 

Ai  Collins -415  975-2686 

Regional  Sales  Manager 

Kevin  Ebmeyer  •  415  975-2684 

Account  Executive 

Derek  Jung  •  415  975-2683 
Fax  •  415  543-2358 

Senior  Account  Executive 

Sara  Mascall  •  415  978-3385 

Ad  Sales  Associate 

Devon  Slattery  •  415  975-2687 

SOUTHERN  CALIFORNIA 

Regional  Sales  Manager 

Kevin  Ebmeyer  •  415  975-2684 

ONLINE  SERVICES 

VP,  Integrated  Media  and 
Online  Sales 

Jim  Alla  •  508  988-6763 

Western  Online  Sales  Manager 

Jennell  Hicks  •  415  243-8585 

Online  Account  Executive 

Danielle  Tetreault 
508988-7969 

Online  Client  Services 
Specialist 

Valerie  Sumner  •  508  988-7877 

Online  Sales  Administrator 

Anne  Butera  •  508  988-6823 


CUSTOM 

PUBLISHING 

VP  of  Program 
Development,  IDG 

Charles  Lee  •  212  867-1229 

VP,  Integrated  Media  and 
Online  Sales 

Jim  Alla  •  508  988-6763 

Director  of  Sales 

Mary  Gregory  •  508  988-6765 

Executive  Editor  and 
Director  of  Operations 

Tom  Field 

Director,  Integrated 
Project  Management 

Mo  Barrett 

Managing  Editor 

Jim  Malone 

Senior  Project  Manager 

Amy  Greenieaf 

Project  Managers 

Karen  Capland, 

Jon  Heinrich 

LIST  SERVICES 

Contact  Paul  Capone  of  IDG  List 
Services  at  508  370-0865  or 
pcapone@idglist.com. 

REPRINT  SERVICES 

For  article  reprints  (100  quan¬ 
tity  or  more),  please  contact 
Jennifer  Eclipse  at  PARS 
International  at  212  221-9595 
x237  or  via  e-mail  at  jeclipse@ 
parsintl.com. 


CIO  is  published  in  the 
U.S.  as  well  as  in: 

Australia,  CIO  Australia 

www.idg.com.au 

Canada,  CIO  Canada 

cio.itworldcanada.com 

China,  CEO  &  CIO  China 

www.ceocio.com.cn 

France,  CIO  France 

www.idg.fr/cio 

Germany,  CIO  Germany 

www.cio.de 

India,  CIO  India 

91-80-521-0309/12 

Japan,  CIO  Japan 

www.idg.co.jp 

The  Netherlands, 

CIO  Netherlands 
www.cio.nl 

New  Zealand,  CIO  New  Zealand 
www.idg.co.nz 

Norway,  CIO  Business  Standard 
www.business-standard.no 
Poland,  0X0  Poland 
www.cxo.pl 

Singapore,  CIO  ACEN/ 
Hong-Kong  www.idg.com.sg 
South  Korea,  CIO  Korea 
www.cio.seoul.kr 
Sweden,  CIO  Sweden 
www.cio.idg.se 

For  further  sales  information: 

www2.cio.com/marketing/ 

aboutcio/contacts.cfm 


CIO  CONTACT 
INFORMATION 

Editorial,  Advertising  and 
Business  Offices:  CXO  Media 
Inc.,  492  Old  Connecticut  Path, 
P.O.  Box  9208,  Framingham,  MA 
01701-9208,  508  872-0080. 

CIO  (ISSN  0894-9301)  is  pub¬ 
lished  semimonthly  and  as  a 
combined  issue  Dec.  15/Jan.  1  by 
CXO  Media  Inc.  Periodicals  post¬ 
age  paid  at  Framingham,  MA,  and 
at  additional  mailing  offices.  Can¬ 
ada  Publications  Mail  Agreement 
Number  1902075.  CANADIAN 
POSTMASTER:  Please  return 
undeliverable  copy  to  P.O.  Box 
1632,  Windsor,  ON  N9A7C9. 

Permissions:  Copyright  2006 
by  CXO  Media  Inc.  All  rights 
reserved.  Reproduction  of 
material  appearing  in  CIO 
is  forbidden  without  written 
permission.  Send  all  requests 
to  Yadira  Pizarro,  PARS  Interna¬ 
tional,  212  221-9595,  Ext.  231, 
oryadira@parsintl.com. 

Photocopy  Rights:  Permission 
to  photocopy  for  internal  or 
personal  use  or  the  internal  or 
personal  use  of  specific  clients  is 
granted  by  CIO  for  users  through 
the  Copyright  Clearance  Center, 
provided  that  the  base  fee  of  $3 
per  copy  of  the  article,  plus  $.50 
per  page  is  paid  directly  to  Copy¬ 
right  Clearance  Center,  27  Con¬ 
gress  Street,  Salem,  MA  01970. 
Please  specify:  ISSN  0894-9301. 
Permission  to  photocopy  does 
not  extend  to  contributed  articles 
followed  by  this  symbol:  $. 

Subscriptions:  CIO  is  free  to 
qualified  information  executives. 
To  apply,  use  our  online  subscrip¬ 
tion  form  at  www.subscribe. 
cio.com.  Subscriptions  are  also 
available  on  a  paid  basis  at  a 
rate  of  $95  for  the  United  States 
and  Canada,  $195  International 
(payable  in  U.S.  funds  only)  and 
may  be  ordered  online  at  www. 
subscribe.cio.com/services. 
html.  Or  address  inquiries  to 
CIO,  P.O.  Box  489,  Northbrook, 

IL  60065-0489:  866  354-1125. 
Please  allow  four  to  six  weeks  for 
a  new  subscription  to  begin.  The 
single  copy  price  is  $9  for  the 
United  States  and  Canada,  and 
$15  International.  Prepayment  is 
required,  payable  in  U.S.  funds. 

Change  of  Address:  Please  go  to 
www.omeda.com/custsrv/cio 
and  follow  the  online  instructions. 

Postmaster:  Send  change  of 
address  to  CIO,  P.O.  Box  489, 
Northbrook,  I L  60065-9816. 
Printed  in  the  U.S. A. 


INDEX  OF  COMPANIES  AND  ADVERTISERS 


Page  numbers  refer  to  the  first  page  of  the  article(s)  in  which  the  company  has  a  substantial  mention. 

This  index  is  provided  as  a  service  to  readers.  The  publisher  does  not  assume  any  liability  for  errors  or  omissions. 


COMPANY  INDEX 

451  Group,  The . 62 

Ace  Hardware  Corp . 36 

American  Electric  Power . 49 

AMI  Partners  Inc . 84 

ARC  Advisory  Group . 19 

ASIMCO  Technologies . 72 

Booz  Allen  Hamilton  Inc . 19 

Cascade  Designs  Inc . 84 

Christian  &  Timbers  . 72 

Con-Way . 49 

Current  Analysis  Inc . 62 

Egon  Zehnder  International  . 72 

Environics  Communications  Inc . 72 

Fastenal  Co . 49 

Forrester  Research  Inc . 19 

Gartner  Inc . 49 

Glacial  Lakes  Energy  LLC . 19 

Heidrick  &  Struggles  International 

Inc . 72 

IBM  Corp . 36 

InStream  Financial  . 49 

Jacob  Stern  &  Sons  Inc . 84 


Lenovo . 72 

Mozilla  Corp . 19 

OHCLLC . 62 

Owens  Corning . 49 

Pacific  Blue  Cross . 44 

Provide  Commerce  Inc . 49 

Sun  Microsystems  Inc . 19 

Transamerica  Life  Insurance  Co . 49 

Westmoreland  Coal  Co . 84 

Whirlpool  Corp . 49 

Wolf,  Greenfield  &  Sachs  PC . 19 

W.P.  Carey  &  Co.  LLC . 84 

ADVERTISER  INDEX 

3M . 27 

AMD . 31 

Apani  Networks  Inc . 39 

CA . C4 

CDWCorp . 35 

Cingular  Wireless . C3 

CXO  Media  Inc . 24, 58,  61,  63,  71 

Dell  Inc . 2 

EMC2  Corp . 9 


Fujitsu  Computer  Systems  Corp . 13 

Hewlett-Packard  Co.  (regional) . 5 

IBM  Corp . 46 

IBM  Corp.  (regional) . 58 

Information  Builders  . 21 

Insight  Direct  USA  Inc . 23 

Integrien  Corp . 48a 

Intel  Corp . 7 

Mexico . 41 

Microsoft  Corp . C2, 19, 33 

MR0  Software  Inc . 55 

Next-Generation  IT  Architecture . 24a 

Orange  Business  Services . 29 

SAP . 37 

Security  Standard,  The . 56 

Siemens  Corp . 17 

SunGard  Availability  Services . 14 

Verizon  Wireless . 11 


70  JULY  15,  2006  |  www.cio.com 


How  do  you  maximize 
the  value  of  IT? 


IT  is  still  one  of  the  most  misunderstood  functions  in  business. 

The  CIO  Executive  Council,  a  professional  community  developed  by  CIOs,  has  focused  its  members' 
collective  effort  on  this  challenge.  Their  initiative  has  resulted  in  groundbreaking  tools-the  IT  Value 
Matrix  and  Knowledge  Center™-to  help  leverage  the  value  of  IT  throughout  the  organization. 

The  IT  Value  Matrix  illustrates  the  principles  and  practices  essential  to  creating,  identifying  and 
communicating  IT's  value  to  the  enterprise.  Its  online  Knowledge  Center  provides  best  practices 
contributed  by  Council  members,  supplemented  by  case  studies  and  how-to  articles  from 
CIO  magazine  that  are  grouped  in  categories  that  correspond  to  all  the  components  of  the  Matrix. 


Visit  www.cioexecutivecouncil.com/it_value  to  get  your  own  copy  of  the  Matrix  and  to  watch 
the  IT  Value  webcast,  presented  by  Agriliance  CIO  and  Council  member  Steven  John. 


CIO  Executive  Council 

The  Professional  Organization  for  CIOs 


The  CIO  Executive  Council  was  created  by  readers  of  CIO  magazine  and  leaders  within 
the  community  of  CIOs  to  leverage  the  individual  and  collective  strengths  of  its  members 
by  serving  as  unbiased  and  trusted  advisors  to  each  other,  and  by  advancing  the 
CIO  role  and  profession.  In  just  two  years,  more  than  300  CIOs  worldwide  from  various 
sectors  and  industries  have  identified  with  the  Council's  vision  and  committed  to  assist 
each  other,  cultivate  their  own  careers  and  those  of  their  team,  and  advance  the  role  of  the 
CIO.  To  inquire  about  membership,  visit  www.cioexecutivecouncil.com. 
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WHAT  IT  SAYS,  WHAT  IT  MEANS 


Deconstructing  a  Mega-Merger 

Sometimes  the  press  release  tells  only  part  of  the  story 


Our  market  has  been 
shrinking,  and  both 
companies  have  been 
sucking  wind. 


PRESS  RELEASE 
For  media  inquiries  contact: 
P.R.  Flacke,  810.555.2812 
prflacke@instantroitoday.com 


July  10  — InstantROI  Software  and  ROIToday  are  joining  forces  to  create 
InstantROI  Today,  now  the  number-one  player  in  the  return  on  investment 


software  sector. 


“Before,  we  could  only  promise  our  customers  instant  ROI,"  said  John  R. 


MacDonald,  chairman  and  CEO  of  InstantROI  Software.  “But  with  this  pow- 


untilit 
no  longer 
makes 
sense. 


Don’t  even  bother 
retrieving  your  stock 
certificates  from  the 
safe  deposit  box. 


We  asked  them  to  clear 
out  their  offices  by  the 
end  of  the  day.  A  com¬ 


erful  combination  of  our  two  companies,  we  can  now  guarantee  a  positive 
return  on  investment  a  full  three  months  before  a  prospective  customer 
picks  up  the  phone  to  call  us.” 

“We’ve  always  admired  the  way  Jack  MacDonald  and  his  company  have  done 
business,"  said  Eric  Waldon,  founder  and  CEO  of  ROIToday. 

The  deal  is  a  true  merger  of  equals.  Mr.  MacDonald  will  retain  the  title  of 
chairman  and  CEO.  Mr.  Waldon's  new  title  will  be  “Chief  Strategy  Officer,” 
and  his  responsibility  primarily  will  consist  of  strategizing. 

The  rest  of  the  ROIToday  management  team  is  leaving  to  spend  more  time 
with  their  families  and  pursue  other  interests. 

The  new  company  pledges  to  continue  to  support  the  full  product  lines  of 
InstantROI  and  ROIToday. 

Along  with  combining  names,  the  two  companies  have  agreed  to  combine 
their  respective  slogans:  “24/7  Support  Til  the  End  of  Time”  and  "When  Any 
Little  Thing  Goes  Wrong,  ROIToday  Is  There  for  You.” 

ROIToday  shareholders  will  receive  0.000004  shares  of  InstantROI  Today 
for  each  share  that  they  own,  plus  three  large  boxes  of  InstantROI  key  chains 
from  last  fall’s  ROI  Now  trade  show. 

“We’re  excited  to  begin  enjoying  the  myriad  synergies  that  this  combination 
will  create,”  said  MacDonald. 

Integration  of  the  two  firms  is  expected  to  be  complete  by  the  end  of  the  year. 


By  then,  everyone  should  have  received 
their  new  business  cards.  As  for  our 
information  systems,  who  knows? 


m 


The  investment 
bankers  said  it 
was  a  good  idea, 
and  the  bonus  I’m 
getting  will  enable 
me  to  re-gild  the 
plumbing  fixtures 
on  my  yacht. 


I  should've 
paid  more 
attention  in 
my  negotia¬ 
tion  class  at 
Wharton. 


New  slogan:  “24/7 
Support  Until  Any¬ 
thing  Goes  Wrong." 


If  the  analysts 
pan  this  deal, 
we’re  all  goners. 
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INTRODUCING  BUILT  IN  BroadbandConnect 


the  only  built  in  wireless  connection 
that  works  in  more  places  than  you  do. 


Get  a  Dell™  Latitude  notebook  equipped  with  Cingular's 
supercharged  wireless  network. 


DOLL 


Available  on  the  Dell  Latitude  D620  and  D820. 
Nothing  to  install.  Just  activate  and  go. 


Access  your  business-critical  information 
in  13,000  cities  and  towns  and  in  100  countries 
around  the  world. 


More  secure  than  Wi-Fi  with  a  wider 
coverage  area  -  no  hotspots  required. 


Runs  on  Cingular's  BroadbandConnect  and  EDGE, 
the  largest  national  high-speed  wireless  data  network. 

Broadband  speeds  on  the  3G  global  standard 
everywhere  BroadbandConnect  is  available. 


CINGULAR  MAKES  BUSINESS  RUN  BETTER 


Click  www.cingular.com/dell 

X  cingular 

raising  the  bar-r.iill 


Coverage  not  available  in  all  areas.  Cingular  covers  273  million  people.  Wireless  service  not  included  with  notebook.  Other  conditions  and  restrictions  apply. 
The  Dell  logo  is  a  trademark  of  Dell  Computer  Corporation.  ©2006  Cingular  Wireless.  All  rights  reserved. 


Remember  when  technology 
had  the  ability  to  amaze  you? 


Believe  again. 

Now  you  can  believe  in  a  new  kind  of  IT  management.  Unified  and  simplified  to  make  your 
business  more  productive,  nimble,  competitive  and  secure. 

We  all  know  that  companies  are  demanding  more  from  IT  —  expecting  IT  to  be  a  strategic 
and  competitive  advantage.  Yet  today's  complex  IT  environments  require  you  to  manage 
across  point  solutions,  siloed  organizations  and  redundant  technology. 

A  better  alternative?  Choose  an  integrated  approach  to  IT  management.  An  approach  in 
which  software  unifies  your  people,  processes  and  technology  to  increase  efficiency  and 
optimization.  Only  one  global  software  company  can  do  that.  CA,  formerly  known  as 
Computer  Associates,  has  focused  solely  on  IT  management  software  for  over  30  years. 

Our  technology  vision  that  makes  this  promise  real  is  called  Enterprise  IT  Management, 
or  EITM.  At  its  heart  is  the  CA  Integration  Platform  —  a  common  foundation  of  shared 
services  that  gives  you  real-time,  dynamic  control  and  flexibility.  Its  greatest  benefit? 

CA  software  solutions  come  to  you  already  integrated,  and  able  to  integrate  with  your 
existing  technology  to  optimize  your  entire  IT  environment. 

Ultimately,  a  well-managed  IT  environment  gives  you  the  visibility  and  control  you  need 
to  manage  risk,  manage  costs,  improve  service  and  align  IT  investments.  To  learn  more 
about  how  CA  and  our  wide  array  of  partners  can  help  you  unify  and  simplify  your  IT 
management,  visit  ca.com/unify. 
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